Test ID:	1.3.6.1.4.1.25623.1.0.64527
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
Summary:	The remote host is missing an update to apache-mod_security;announced via advisory MDVSA-2009:184.
Description:	Summary: The remote host is missing an update to apache-mod_security announced via advisory MDVSA-2009:184. Vulnerability Insight: Multiple vulnerabilities has been found and corrected in mod_security: The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference (CVE-2009-1902). The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method (CVE-2009-1903). This update provides mod_security 2.5.9, which is not vulnerable to these issues. Affected: Enterprise Server 5.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1902 BugTraq ID: 34096 http://www.securityfocus.com/bid/34096 Bugtraq: 20090319 [ISecAuditors Security Advisories] ModSecurity < 2.5.9 remote Denial of Service (Google Search) http://www.securityfocus.com/archive/1/501968 https://www.exploit-db.com/exploits/8241 https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00487.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00529.html http://security.gentoo.org/glsa/glsa-200907-02.xml http://www.osvdb.org/52553 http://secunia.com/advisories/34256 http://secunia.com/advisories/34311 http://secunia.com/advisories/35687 SuSE Security Announcement: SUSE-SR:2009:011 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html http://www.vupen.com/english/advisories/2009/0703 XForce ISS Database: modsecurity-multipart-dos(49212) https://exchange.xforce.ibmcloud.com/vulnerabilities/49212 Common Vulnerability Exposure (CVE) ID: CVE-2009-1903 http://www.osvdb.org/52552 XForce ISS Database: modsecurity-pdfxss-dos(49211) https://exchange.xforce.ibmcloud.com/vulnerabilities/49211
Copyright	Copyright (C) 2009 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.