CVE-2009-1902: Null Pointer Dereference
Published Jun 3, 2009
·Updated
The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference.
Affected Software
3 affected components
Trustwave ModSecurity<2.5.9
Fedoraproject Fedora=10
Fedoraproject Fedora=9
Event History
Jun 3, 2009
CVE Published
via MITRE·04:33 PM
Data Sourced
via MITRE·04:33 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-1902?
CVE-2009-1902 is rated as a high severity vulnerability due to its ability to cause a denial of service.
2
How do I fix CVE-2009-1902?
To fix CVE-2009-1902, upgrade ModSecurity to version 2.5.9 or later.
3
What type of attack does CVE-2009-1902 enable?
CVE-2009-1902 allows remote attackers to trigger a denial of service by exploiting multipart form datapost requests.
4
Which software versions are affected by CVE-2009-1902?
CVE-2009-1902 affects all versions of ModSecurity prior to 2.5.9 and specific Fedora versions including 9 and 10.
5
What happens when CVE-2009-1902 is exploited?
Exploiting CVE-2009-1902 can lead to a crash of the ModSecurity service due to a NULL pointer dereference.