NVD Vulnerability Detail

CVE-2012-2751

Summary	ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.
Publication Date	July 23, 2012, 1:55 a.m.
Registration Date	Jan. 28, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 10:39 a.m.

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:trustwave:modsecurity::::::::					2.6.6

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:12.2:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*
cpe:2.3:o:debian:debian_linux:6.0:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:oracle:http_server:11.1.1.6.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html	Third Party Advisory
2	http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html	Mailing List Third Party Advisory
9	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES	Broken Link
10	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES	Broken Link
11	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?r1=1918&r2=1917&pathrev=1918	Broken Link
12	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?r1=1918&r2=1917&pathrev=1918	Broken Link
13	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920	Broken Link
14	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920	Broken Link
15	http://secunia.com/advisories/49576	Third Party Advisory
16	http://secunia.com/advisories/49576	Third Party Advisory
17	http://secunia.com/advisories/49782	Third Party Advisory
18	http://secunia.com/advisories/49782	Third Party Advisory
19	http://www.debian.org/security/2012/dsa-2506	Third Party Advisory
20	http://www.debian.org/security/2012/dsa-2506	Third Party Advisory
21	http://www.mandriva.com/security/advisories?name=MDVSA-2012:118	Third Party Advisory
22	http://www.mandriva.com/security/advisories?name=MDVSA-2012:118	Third Party Advisory
23	http://www.mandriva.com/security/advisories?name=MDVSA-2013:150	Third Party Advisory
24	http://www.mandriva.com/security/advisories?name=MDVSA-2013:150	Third Party Advisory
25	http://www.openwall.com/lists/oss-security/2012/06/22/1	Mailing List Third Party Advisory
26	http://www.openwall.com/lists/oss-security/2012/06/22/1	Mailing List Third Party Advisory
27	http://www.openwall.com/lists/oss-security/2012/06/22/2	Mailing List Third Party Advisory
28	http://www.openwall.com/lists/oss-security/2012/06/22/2	Mailing List Third Party Advisory
29	http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html	Third Party Advisory
30	http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html	Third Party Advisory
31	http://www.securityfocus.com/bid/54156	Third Party Advisory VDB Entry
32	http://www.securityfocus.com/bid/54156	Third Party Advisory VDB Entry

Common Vulnerabilities List

JVN Vulnerability Information

ModSecurity におけるフィルタリングルールを回避される脆弱性

Title	ModSecurity におけるフィルタリングルールを回避される脆弱性
Summary	ModSecurity は、PHP で使用する場合、multipart/form-data Content-Type ヘッダを伴うリクエストの Content-Disposition フィールドに含まれるリクエストパラメータの値の先頭のシングルクォートを適切に処理しないため、フィルタリングルールを回避される、およびクロスサイトスクリプティング (XSS) 攻撃などその他の攻撃を実行される脆弱性が存在します。本脆弱性は、CVE-2009-5031 に対する修正が不十分だったことによる脆弱性です。
Possible impacts	第三者により、フィルタリングルールを回避される、およびクロスサイトスクリプティング (XSS) 攻撃などその他の攻撃を実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 22, 2012, midnight
Registration Date	July 24, 2012, 4:28 p.m.
Last Update	Aug. 11, 2014, 5:09 p.m.

Affected System

オラクル

Oracle HTTP Server 11.1.1.6.0

ModSecurity

ModSecurity 2.6.6 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2751	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2751
National Vulnerability Database (NVD)
2	CVE-2012-2751	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2751
SECURITY BLOG
3	CVE-2012-2751 Improper Input Validation vulnerability in ModSecurity	https://blogs.oracle.com/sunsecurity/entry/cve_2012_2751_improper_input

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian セキュリティ勧告
1	DSA-2506-1	http://www.debian.org/security/2012/dsa-2506
ModSecurity
2	2.6.x/CHANGES	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES
3	Top Page	http://www.modsecurity.org/
Oracle Critical Patch Update
4	Oracle Critical Patch Update Advisory - April 2013	http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
5	Text Form of Oracle Critical Patch Update - April 2013 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapril2013verbose-1899563.html
Security Advisories
6	MDVSA-2012:118	http://www.mandriva.com/en/support/security/advisories/?name=MDVSA-2012:118
SECURITY BLOG
7	April 2013 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2013_critical_patch_update
SourceForge
8	SCM Repositories - mod-security_CHANGES	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920
9	SCM Repositories - mod-security_msc_multipart.c	http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?r1=1918&r2=1917&pathrev=1918

Change Log

No	Changed Details	Date of change
0	[2012年07月24日] 掲載 [2012年08月10日] ベンダ情報：Mandriva, Inc. (MDVSA-2012:118) を追加 [2013年04月19日] 影響を受けるシステム：オラクル (Oracle Critical Patch Update Advisory - April 2013) の情報を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - April 2013) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - April 2013 Risk Matrices) を追加ベンダ情報：オラクル (April 2013 Critical Patch Update Released) を追加 [2014年08月11日] ベンダ情報：オラクル (CVE-2012-2751 Improper Input Validation vulnerability in ModSecurity) を追加	Feb. 17, 2018, 10:37 a.m.