[Owasp-modsecurity-core-rule-set] Announcing Release of OWASP ModSecurity CRS v2.2.0

Ryan Barnett RBarnett at trustwave.com
Thu May 26 19:11:32 EDT 2011


Hello everyone,
I am pleased to announce the release of the OWASP ModSecurity Core Rule Set (CRS) v2.2.0.  This is a significant update as we have added a number of very important capabilities.

CHANGE LOG -

--------------------------
Version 2.2.0 - 05/26/2011
--------------------------

Improvements:
- Changed Licensing from GPLv2 to Apache Software License v2 (ASLv2)
  http://www.apache.org/licenses/LICENSE-2.0.txt
- Created new INSTALL file outlining quick config setup
- Added a new rule regression testing framework to the /util directory
- Added new activated_rules directory which will allow users to place symlinks pointing
  to files they want to run.  This allows for easier Apache Include wild-carding
- Adding in new RULE_MATURITY and RULE_ACCURACY tags
- Adding in a check for X-Forwarded-For source IP when creating IP collection
- Added new Application Defect checks (55 app defect file) from Watcher tool (Check Charset)
  http://websecuritytool.codeplex.com/wikipage?title=Checks#charset
- Added new AppSensor rules to experimental_dir
  https://www.owasp.org/index.php/AppSensor_DetectionPoints
- Added new Generic Malicious JS checks in outbound content
- Added experimental IP Forensic rules to gather Client hostname/whois info  http://blog.spiderlabs.com/2010/11/detecting-malice-with-modsecurity-ip-forensics.html
- Added support for Mozilla's Content Security Policy (CSP) to the experimental_rules
  http://blog.spiderlabs.com/2011/04/modsecurity-advanced-topic-of-the-week-integrating-content-security-policy-csp.html
- Global collection in the 10 file now uses the Host Request Header as the collection key.
  This allows for per-site global collections.
- Added new SpiderLabs Research (SLR) rules directory (slr_rules) for known vulnerabilties.
  This includes both converted web rules from Emerging Threats (ET) and from SLR Team.
- Added new SLR rule packs for known application vulns for WordPress, Joomla and phpBB
- Added experimental rules for detecting Open Proxy Abuse
  http://blog.spiderlabs.com/2011/03/detecting-malice-with-modsecurity-open-proxy-abuse.html
- Added experimental Passive Vulnerability Scanning ruleset using OSVDB and Lua API
  http://blog.spiderlabs.com/2011/02/modsecurity-advanced-topic-of-the-week-passive-vulnerability-scanning-part-1-osvdb-checks.html
- Added additional URI Request Validation rule to the 20 protocol violations file (Rule ID - 981227)
- Added new SQLi detection rules (959070, 959071 and 959072)
- Added "Toata dragostea mea pentru diavola" to the malicious User-Agent data
  https://www.modsecurity.org/tracker/browse/CORERULES-64

Bug Fixes:
- Assigned IDs to all active SecRules/SecActions
- Removed rule inversion (!) from rule ID 960902
- Fixed false negative issue in Response Splitting Rule
- Fixed false negative issue with @validateByteRange check
- Updated the TARGETS lising for rule ID 950908
- Updated TX data for REQBODY processing
- Changed the pass action to block in the RFI rules in the 40 generic file
- Updated RFI regex to catch IP address usage in hostname
  https://www.modsecurity.org/tracker/browse/CORERULES-68
- Changed REQUEST_URI_RAW variable to REQUEST_LINE in SLR rules to allow matches on request methods.
- Updated the RFI rules in the 40 generic attacks conf file to remove explicit logging actions.
  They will now inherit the settings from the SecDefaultAction

--------------------------
DOWNLOADING
--------------------------
Manual Downloading:
You can always download the latest CRS version here -
https://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/

Automated Downloading:
Use the rules-updater.pl script in the CRS /util directory

# Get a list of what the repository contains:
$ ./rules-updater.pl -rhttp://www.modsecurity.org/autoupdate/repository/ -l

Repository: http://www.modsecurity.org/autoupdate/repository

modsecurity-crs {
          2.0.0: modsecurity-crs_2.0.0.zip
          2.0.1: modsecurity-crs_2.0.1.zip
          2.0.2: modsecurity-crs_2.0.2.zip
          2.0.3: modsecurity-crs_2.0.3.zip
          2.0.4: modsecurity-crs_2.0.4.zip
          2.0.5: modsecurity-crs_2.0.5.zip
          2.0.6: modsecurity-crs_2.0.6.zip
          2.0.7: modsecurity-crs_2.0.7.zip
          2.0.8: modsecurity-crs_2.0.8.zip
          2.0.9: modsecurity-crs_2.0.9.zip
          2.0.9: modsecurity-crs_2.0.10.zip
          2.1.0: modsecurity-crs_2.1.0.zip
          2.1.1: modsecurity-crs_2.1.1.zip
          2.1.2: modsecurity-crs_2.1.2.zip
  2.2.0: modsecurity-crs_2.2.0.zip
}

# Get the latest stable version of "modsecurity-crs":
$ ./rules-updater.pl -rhttp://www.modsecurity.org/autoupdate/repository/ -prules -Smodsecurity-crs
Fetching: modsecurity-crs/modsecurity-crs_2.2.0.zip ...
$ ls -R rules
modsecurity-crs

rules/modsecurity-crs:
modsecurity-crs_2.2.0.zip    modsecurity-crs_2.2.0.zip.sig

--
Ryan Barnett
OWASP ModSecurity CRS Project Leader

________________________________
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.



More information about the Owasp-modsecurity-core-rule-set mailing list