Projects/OWASP ModSecurity Core Rule Set Project

PROJECT INFO What does this OWASP project offer you?

RELEASE(S) INFO What releases are available for this project?

what is this project? Name: OWASP ModSecurity Core Rule Set Project (home page) Purpose: ModSecurity is an Apache web server module that provides a web application firewall engine. The ModSecurity Rules Language engine is extrememly flexible and robust and has been referred to as the "Swiss Army Knife of web application firewalls." While this is certainly true, it doesn't do much implicitly on its own and requires rules to tell it what to do. In order to enable users to take full advantage of ModSecurity out of the box, we have developed the Core Rule Set (CRS) which provides critical protections against attacks across most every web architecture. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the CRS is based on generic rules which focus on attack payload identification in order to provide protection from zero day and unknown vulnerabilities often found in web applications, which are in most cases custom coded. License: GNU General Public License - Version 2.0 who is working on this project? Project Leader(s): Ryan Barnett @ Project Contributor(s): Breno Silva how can you learn more? Project Pamphlet: Not Yet Created Project Presentation: View Mailing list: Mailing List Archives Project Roadmap: View Main links: ModSecurity on SourceForge Bug Tracker Installation Documentation PPT Presentation PDF Withepaper Key Contacts Contact Ryan Barnett @ to contribute to this project Contact Ryan Barnett @ to review or sponsor this project

current release ModSecurity 2.2.8 - 06/30/2013 - (download) Release description: == Version 2.2.8 - 06/30/2013 == Security Fixes: Improvements: Updatd the /util directory structure Added scripts to check Rule ID duplicates Added script to remove v2.7 actions so older ModSecurity rules will work - https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/43 Added new PHP rule (958977) to detect PHP exploits (Plesk 0-day from king cope) - http://seclists.org/fulldisclosure/2013/Jun/21 - http://blog.spiderlabs.com/2013/06/honeypot-alert-active-exploits-attempts-for-plesk-vulnerability-.html Bug Fixes: fix 950901 - word boundary added - https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/48 fix regex error - https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/44 Updated the Regex in 981244 to include word boundaries - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/36 Problem with Regression Test (Invalid use of backslash) - Rule 960911 - Test2 - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/34 ModSecurity: No action id present within the rule - ignore_static.conf - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/17 "Bad robots" rule blocks all Java applets on Windows XP machines - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/16 duplicated rules id 981173 - https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/18 Rating: Projects/OWASP ModSecurity Core Rule Set Project/GPC/Assessment/ModSecurity 2.2.8 last reviewed release ModSecurity 2.0.6 - 2010-02-26 - (download) Release description: ModSecurity is a web application firewall that can work either embedded or as a reverse proxy. It provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. Rating: Stable Release - Assessment Details other releases ModSecurity 2.0.10 ModSecurity 2.0.8 ModSecurity 2.0.7 ModSecurity 2.0.6