mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-14 13:56:01 +03:00
67 lines
2.5 KiB
Plaintext
67 lines
2.5 KiB
Plaintext
|
|
|
|
version 1.3.2 build 4 2007/01/17
|
|
|
|
Fixed apache 2.4 dummy requests exclusion
|
|
Added persistent PDF UXSS detection rule
|
|
|
|
|
|
Vervion 1.3.2 build 3 2007/01/10
|
|
|
|
Fixed regular expresion in rule 960010 (file #30) to allow mulipart-data content
|
|
|
|
|
|
Version 1.3.2 - 2006/12/27
|
|
|
|
New events:
|
|
- 960037 Directory is restricted by policy
|
|
- 960038 HTTP header is restricted by policy
|
|
|
|
Regular expressions fixes:
|
|
- Regular expressions with @ at end of beginning (for example "@import)
|
|
- Regular expressions with un-escaped "."
|
|
- Command Injections now always require certain characters both before and after the command. Important since many are common English words (finger, mail)
|
|
- The command injection wget is not searched in the UA header as it has different meaning there.
|
|
- LDAP Fixed to reduce FPs:
|
|
+ More accurate regular expressions
|
|
+ high bit characters not accpeted between signature tokens.
|
|
- Do not detect <?xml as a PHP tag in both PHP injection and PHP source leakage
|
|
- Removed Java from automation UA
|
|
- When validating encoding, added regexp based chained rule that accepts both %xx and %uxxxxx encoding bypassing a limitation of "@validateUrlEncoding"
|
|
|
|
Additional rules logic:
|
|
- Checks for empty headers in addition to missing ones (Host, Accept and User-Agent)
|
|
- OPTIONS method does not require an accept header.
|
|
- Apache keep alive request exception.
|
|
- PROPFIND and OPTIONS can be used without content-encoding (like HEAD and GET)
|
|
- Validate byte range checks by default only that no NULL char exists.
|
|
- Added CSS to allowed extensions in strict rule sets.
|
|
- Changed default action in file #50 to pass instead of deny.
|
|
- Moved IP host header from protocol violations to protocol anomalies.
|
|
|
|
Modified descriptions:
|
|
- 950107: URL Encoding Abuse Attack Attempt
|
|
- 950801: UTF8 Encoding Abuse Attack Attempt
|
|
- Added matched pattern in many events using capture and %{TX.0}
|
|
- Added ctl:auditLogParts=+E for outbound events and attacks to collect response.
|
|
|
|
--
|
|
Version 1.2 - 2006/11/19
|
|
|
|
Changes:
|
|
+ Move all events to the range of events allocated to Thinking Stone, now Breach
|
|
by prefixing all event IDs with "9".
|
|
+ Reverse severities to follow the Syslog format used by ModSecurity, now 1 is
|
|
the highest and 5 the lowest.
|
|
|
|
Bug fixes:
|
|
+ Removed quotes from list of mime types inspected on exit (directive
|
|
SecResponseBodyMimeType)
|
|
+ Corrected "cd .." signature. Now the periods are escaped.
|
|
+ Too many FPs with events 950903 & 950905. Commented them out until fixed.
|
|
|
|
--
|
|
Version 1.1 - 2006/10/18
|
|
|
|
Initial version
|