CVE-2009-1902

MEDIUM 5.0CVE-2009-1902 · Published 03/06/2009 · updated 16/06/2026

Package	Affected versions	Patched versions
modsecurity trustwave	`< 2.5.9`	`2.5.9`

Description

The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference.

References

lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html · Not Applicable
secunia.com/advisories/34256 · Third Party Advisory
secunia.com/advisories/34311 · Third Party Advisory
secunia.com/advisories/35687 · Third Party Advisory
security.gentoo.org/glsa/glsa-200907-02.xml · Third Party Advisory
sourceforge.net/project/shownotes.php · Third Party Advisory
osvdb.org/52553 · Broken Link
securityfocus.com/archive/1/501968 · Exploit
securityfocus.com/bid/34096 · Exploit
vupen.com/english/advisories/2009/0703 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/49212 · Third Party Advisory
exploit-db.com/exploits/8241 · Exploit
redhat.com/archives/fedora-package-announce/2009-March/msg00487.html · Third Party Advisory
redhat.com/archives/fedora-package-announce/2009-March/msg00529.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free