Description
The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
References
- FEDORA-2009-2654 vendor-advisory
- 52552 vdb-entry
- GLSA-200907-02 vendor-advisory
- 34256 third-party-advisory
- 35687 third-party-advisory
- 34311 third-party-advisory
- FEDORA-2009-2686 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=667538
- modsecurity-pdfxss-dos(49211) vdb-entry
- ADV-2009-0703 vdb-entry
- 34096 vdb-entry