OGH DBA Dag 14 september 2010 Frits Hoogland

mod_security Some of the rules it triggered:Message: Operator EQ matched 0 at REQUEST_HEADERS. [file "/oracle/Oracle_WT1/instances/instance1/config/OHS/ohs1/modsecurity.d/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "28"] [id "960008"] [rev "2.0.5"] [msg"Request Missing a Host Header"] [severity "NOTICE"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]– Request missing a Host headerMessage: Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/oracle/Oracle_WT1/instances/instance1/config/OHS/ohs1/modsecurity.d/base_rules/modsecurity_crs_30_http_policy.conf"] [line "30"] [id "960032"] [msg "Method is not allowedby policy"] [data "CONNECT"] [severity "CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [tag"WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"]53– CONNECT is not an accepted methodMessage: Access denied with code 403 (phase 2). [file "/oracle/Oracle_WT1/instances/instance1/config/OHS/ohs1/modsecurity.d/base_rules/modsecurity_crs_49_enforcement.conf"][line "25"] [msg "Anomaly Score Exceeded (score 30): Method is not allowed by policy"]Action: Intercepted (phase 2)– And intercepted based on score!Tuesday, September 14, 2010