ModSecurity CRS RuleID-960911 - Revision history

Rcbarnett: /* Rule ID: 906911 */

2011-05-09T17:29:43Z

‎Rule ID: 906911

Rcbarnett at 14:58, 6 May 2011

2011-05-06T14:58:42Z

Rcbarnett at 14:19, 6 May 2011

2011-05-06T14:19:30Z

Rcbarnett at 20:45, 5 May 2011

2011-05-05T20:45:42Z

Rcbarnett at 17:11, 15 November 2010

2010-11-15T17:11:34Z

Rcbarnett at 17:11, 15 November 2010

2010-11-15T17:11:07Z

Rcbarnett at 21:14, 7 October 2010

2010-10-07T21:14:45Z

Rcbarnett at 15:55, 20 September 2010

2010-09-20T15:55:44Z

Rcbarnett at 15:41, 20 September 2010

2010-09-20T15:41:21Z

Show changes

Rcbarnett at 15:36, 20 September 2010

2010-09-20T15:36:31Z

Show changes

@@ Line 152: / Line 152: @@
 '''None known'''
 </td></tr>
-<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Accuracy Level</td>
+<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Maturity</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
-'''5''' <br>5 point scale where:<br>1 = Beta/Experimental and/or high number of false positives reported<br>5 = Strong Rule and/or no false positives reported
+'''8'''<br>
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Documentation Contributor(s)</td>

@@ Line 20: / Line 20: @@
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
-<code>SecRule REQUEST_LINE "!^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" \
+<code>
-"t:none,t:lowercase,phase:2,rev:'2.0.9',block,msg:'Invalid HTTP Request Line',id:'960911',severity:'4',tag:'http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.2.1',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},setvar:tx.protocol_violation_score=+%{tx.notice_anomaly_score},setvar:'tx.%{rule.id}-PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}'"</code>
+ SecRule REQUEST_LINE "!^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" \
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Detailed Rule Information</td>
@@ Line 139: / Line 140: @@
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >False Positives</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
-None known
+'''None known'''<br>
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >False Negatives</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
-None known
+'''None known'''
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Accuracy Level</td>

@@ Line 145: / Line 145: @@
 None known
 </td></tr>
-<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Accuracy / Confidence Level</td>
+<tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Accuracy Level</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 '''5''' <br>5 point scale where:<br>1 = Beta/Experimental and/or high number of false positives reported<br>5 = Strong Rule and/or no false positives reported

@@ Line 144: / Line 144: @@
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 None known
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Documentation Contributor(s)</td>

@@ Line 21: / Line 21: @@
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
 <code>SecRule REQUEST_LINE "!^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" \
-"t:none,t:lowercase,phase:2,rev:'2.0.9',block,nolog,auditlog,msg:'Invalid HTTP Request Line',id:'960911',severity:'4',tag:'http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.2.1',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},setvar:tx.protocol_violation_score=+%{tx.notice_anomaly_score},setvar:'tx.%{rule.id}-PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}'"</code>
+"t:none,t:lowercase,phase:2,rev:'2.0.9',block,msg:'Invalid HTTP Request Line',id:'960911',severity:'4',tag:'http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.2.1',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},setvar:tx.protocol_violation_score=+%{tx.notice_anomaly_score},setvar:'tx.%{rule.id}-PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}'"</code>
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Detailed Rule Information</td>

@@ Line 147: / Line 147: @@
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Rule Documentation Contributor(s)</td>
 <td style="background-color:#F2F2F2;table-layout:fixed;width:700px;" >
-Ryan Barnett - rcbarnett[[Image:Justat.gif|10px]]gmail.com
+Ryan Barnett - ryan.barnett[[Image:Justat.gif|10px]]owasp.org
 </td></tr>
 <tr><td style="border-style:solid;border-width:1px;background-color:#CCCCCC;text-transform:uppercase " >Additional References</td>

← Older revision		Revision as of 15:55, 20 September 2010
Line 154:		Line 154:
	</td></tr>		</td></tr>
	</table>		</table>
		+	[[Category:OWASP ModSecurity Core Rule Set Project]]