PCRE limits exceeded, but triggering rules are SQL related

Posted by Wolfe on Server Fault See other posts from Server Fault or by Wolfe
Published on 2012-10-16T16:14:59Z Indexed on 2012/10/16 17:06 UTC
Read the original article Hit count: 325

Filed under:
|

[Mon Oct 15 17:12:13 2012] [error] [client xx.xx.xx.xx] ModSecurity: Rule 1d4ad30 [id "300014"][file "/usr/local/apache/conf/modsec2.user.conf"][line "349"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "domain.com"] [uri "/admin.php"] [unique_id "UHx8LEUQwYEAAGutKkUAAAEQ"]

And similar are spamming my error log for apache.

It's only the admin side.. and only these two lines in the config: line 349:

#Generic SQL sigs
SecRule ARGS "(or.+1[[:space:]]*=[[:space:]]1|(or 1=1|'.+)--')" "id:300014,rev:1,severity:2,msg:'Generic SQL injection protection'"

And line 356:

SecRule ARGS "(insert[[:space:]]+into.+values|select.*from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\(.*from)"

Is there a way to fix this problem? Can someone explain what is going on or if these rules are even valid to cause this error? I know it's supposedly a recursion protection.. but these protect against SQL injection so I'm confused.

© Server Fault or respective owner

Related posts about centos

Related posts about mod-security