I am pleased to announce the release of OWASP ModSecurity CRS v2.2.2. =========== CHANGELOG =========== -------------------------- Version 2.2.2 - 09/28/2011 --------------------------
Improvements: - Updated the AppSensor Profiling (to use Lua scripts) for Request Exceptions Detection Points http://blog.spiderlabs.com/2011/08/implementing-appsensor-detection-points-in-modsecurity.html - Added new Range header detection checks to prevent Apache DoS http://blog.spiderlabs.com/2011/08/mitigation-of-apache-range-header-dos-attack.html - Added new Security Scanner User-Agent strings - Added example script to the /util directory to convert Arachni DAST scanner XML data into ModSecurity virtual patching rules. http://blog.spiderlabs.com/2011/08/modsecurity-advanced-topic-of-the-week-automated-virtual-patching-script.html - Updated the SQLi Character Anomaly Detection Rules - Added Host header info to the RESOURCE collection key for AppSensor profiling rules Bug Fixes: - Fixed action list for XSS rules (replaced pass,nolog,auditlog with block) - Fixed Request Limit rules by removing & from variables - Fixed Session Hijacking IP/UA hash captures - Updated the SQLi regex for rule ID 981242 -------------------------- DOWNLOADING -------------------------- Manual Downloading: You can always download the latest CRS version here - https://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ Automated Downloading: Use the rules-updater.pl script in the CRS /util directory # Get a list of what the repository contains: $ ./rules-updater.pl -rhttp://www.modsecurity.org/autoupdate/repository/ -l Repository: http://www.modsecurity.org/autoupdate/repository modsecurity-crs { 2.0.0: modsecurity-crs_2.0.0.zip 2.0.1: modsecurity-crs_2.0.1.zip 2.0.2: modsecurity-crs_2.0.2.zip 2.0.3: modsecurity-crs_2.0.3.zip 2.0.4: modsecurity-crs_2.0.4.zip 2.0.5: modsecurity-crs_2.0.5.zip 2.0.6: modsecurity-crs_2.0.6.zip 2.0.7: modsecurity-crs_2.0.7.zip 2.0.8: modsecurity-crs_2.0.8.zip 2.0.9: modsecurity-crs_2.0.9.zip 2.0.9: modsecurity-crs_2.0.10.zip 2.1.0: modsecurity-crs_2.1.0.zip 2.1.1: modsecurity-crs_2.1.1.zip 2.1.2: modsecurity-crs_2.1.2.zip 2.2.0: modsecurity-crs_2.2.0.zip 2.2.1: modsecurity-crs_2.2.1.zip 2.2.2: modsecurity-crs_2.2.2.zip } # Get the latest stable version of "modsecurity-crs": $ ./rules-updater.pl -rhttp://www.modsecurity.org/autoupdate/repository/ -prules -Smodsecurity-crs Fetching: modsecurity-crs/modsecurity-crs_2.2.2.zip ... $ ls -R rules modsecurity-crs rules/modsecurity-crs: modsecurity-crs_2.2.2.zip modsecurity-crs_2.2.2.zip.sig -- Ryan Barnett OWASP ModSecurity Core Rule Set Project Lead ________________________________ This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. _______________________________________________ Owasp-modsecurity-core-rule-set mailing list [email protected] https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
