CVE-2009-1902 The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a...
MediumCVSS 5.0
EPSS 13.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trustwave modsecurity | < 2.5.9 | 2.5.9 |
| fedoraproject fedora | = 9 | No fix listed |
| fedoraproject fedora | = 10 | No fix listed |
References
- SUSE-SR:2009:011 not-applicable vendor-advisory
- 34256 third-party-advisory
- 34311 third-party-advisory
- 35687 third-party-advisory
- GLSA-200907-02 third-party-advisory vendor-advisory
- sourceforge.net third-party-advisory
- 52553 broken-link vdb-entry
- 20090319 [ISecAuditors Security Advisories] ModSecurity < 2.5.9 remote Denial of Service exploit mailing-list third-party-advisory vdb-entry
- 34096 exploit third-party-advisory vdb-entry
- ADV-2009-0703 third-party-advisory vdb-entry
- modsecurity-multipart-dos(49212) third-party-advisory vdb-entry
- 8241 exploit third-party-advisory vdb-entry
- FEDORA-2009-2654 third-party-advisory vendor-advisory
- FEDORA-2009-2686 third-party-advisory vendor-advisory