Executive Summary
| Summary | |
|---|---|
| Title | libapache-mod-security security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2659 | First vendor Publication | 2013-04-09 |
| Vendor | Debian | Last vendor Modification | 2013-04-09 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Timur Yunusov and Alexey Osipov from Positive Technologies discovered that the XML files parser of ModSecurity, an Apache module whose purpose is to tighten the Web application security, is vulnerable to XML external entities attacks. A specially-crafted XML file provided by a remote attacker, could lead to local file disclosure or excessive resources (CPU, memory) consumption when processed. This update introduces a SecXmlExternalEntity option which is 'Off' by default. This will disable the ability of libxml2 to load external entities. For the stable distribution (squeeze), this problem has been fixed in version 2.5.12-1+squeeze2. For the testing distribution (wheezy), this problem has been fixed in version 2.6.6-6 of the modsecurity-apache package. For the unstable distribution (sid), this problem has been fixed in version 2.6.6-6 of the modsecurity-package package. We recommend that you upgrade your libapache-mod-security packages. |
Original Source
| Url : http://www.debian.org/security/2013/dsa-2659 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-611 | Information Leak Through XML External Entity File Disclosure |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18056 | |||
| Oval ID: | oval:org.mitre.oval:def:18056 | ||
| Title: | DSA-2659-1 libapache-mod-security - XML external entity processing vulnerability | ||
| Description: | Timur Yunusov and Alexey Osipov from Positive Technologies discovered that the XML files parser of ModSecurity, an Apache module whose purpose is to tighten the Web application security, is vulnerable to XML external entities attacks. A specially-crafted XML file provided by a remote attacker, could lead to local file disclosure or excessive resources (CPU, memory) consumption when processed. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2659-1 CVE-2013-1915 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | libapache-mod-security |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:20773 | |||
| Oval ID: | oval:org.mitre.oval:def:20773 | ||
| Title: | RHSA-2013:0769: glibc security and bug fix update (Low) | ||
| Description: | ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2013:0769-01 CESA-2013:0769 CVE-2013-0242 CVE-2013-1914 CVE-2013-1915 | Version: | 45 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | glibc |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:23352 | |||
| Oval ID: | oval:org.mitre.oval:def:23352 | ||
| Title: | ELSA-2013:0769: glibc security and bug fix update (Low) | ||
| Description: | ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013:0769-01 CVE-2013-0242 CVE-2013-1914 CVE-2013-1915 | Version: | 17 |
| Platform(s): | Oracle Linux 5 | Product(s): | glibc |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_modsecurity_20140731.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-640.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-641.nasl - Type : ACT_GATHER_INFO |
| 2013-07-02 | Name : The remote web application firewall may be affected by a file disclosure vuln... File : modsecurity_2_7_3.nasl - Type : ACT_GATHER_INFO |
| 2013-04-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-156.nasl - Type : ACT_GATHER_INFO |
| 2013-04-22 | Name : The remote Fedora host is missing a security update. File : fedora_2013-4908.nasl - Type : ACT_GATHER_INFO |
| 2013-04-17 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_2070c79a8e1e11e2b34d000c2957946c.nasl - Type : ACT_GATHER_INFO |
| 2013-04-14 | Name : The remote Fedora host is missing a security update. File : fedora_2013-4831.nasl - Type : ACT_GATHER_INFO |
| 2013-04-14 | Name : The remote Fedora host is missing a security update. File : fedora_2013-4834.nasl - Type : ACT_GATHER_INFO |
| 2013-04-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2659.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:31:47 |
|
| 2013-04-26 21:21:02 |
|
| 2013-04-26 13:20:19 |
|
| 2013-04-10 21:18:22 |
|
