ModSecurity (mod_security) contains a flaw that is triggered during the parsing of multipart requests. By sending a crafted POST request that manipulates the Content-Disposition header and extra lines (e.g. carriage return [\r\r\n]), a remote attacker may bypass certain security filters and execute web-based attacks.

Upgrade to version 2.70 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027706
• CVE ID: 2012-4528 (see also: NVD)
• Secunia Advisory ID: 49853
• Bugtraq ID: 56096
• ISS X-Force ID: 79400
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2012-10/0114.html
• Vendor Specific News/Changelog Entry: http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES
• Packet Storm: http://packetstormsecurity.org/files/119074/Mandriva-Linux-Security-Advisory-2012-182.html
  http://packetstormsecurity.org/files/119085/Mandriva-Linux-Security-Advisory-2012-183.html
• Vendor Specific Advisory URL: http://www.mandriva.com/en/support/security/advisories/mbs1/MDVSA-2013:029/
• Vendor URL: http://www.modsecurity.org/

• Bernhard Mueller - SEC Consult Unternehmensberatung GmbH