[mod-security-users] request body: Multipart: invalid boundary encountered

[peter p. <pi...@go...>]

I simply cant figure out whats going on.  A single user cannot access a 
certain webpage on my server (403 by mod_security).  All other users 
(including myself) dont have any problems doing so.  The "bad user" can 
surf the whole page, but as soon as he submits a searchterm he gets a 
403.  He has no problems with submitting terms at other forms or search 
at google ;)

I couldnt find any rule in the rule-set that correspond with the terms 
in audit-log. I googled unsuccessful for a similar problem.

I dont have any clue how to solve this issue and I dont have any clue 
what the 'Extension: Security/Remote-Passphrase' - means. I found it a 
few times at google but it seems not related with mod_security but maybe 
with my problem?

thnx for any hints, ideas and solutions ..

thnx
peter



==ddfbd861==============================
Request: www.adulteducation.at 80.121.27.113 - - [18/Apr/2006:10:29:05 
+0200] "POST /de/struktur/suchergebnis//sd/1/ HTTP/1.1" 403 304 
"http://www.adultedu
cation.at/de/struktur/" "Mozilla/4.0 (compatible; MSIE 5.0; 
Mac_PowerPC)" VQ8V8D5jlYoAAFjp7WQAAAAF "-"
Handler: perl-script
----------------------------------------
POST /de/struktur/suchergebnis//sd/1/ HTTP/1.1
Host: www.adulteducation.at
Accept: */*
Accept-Language: de
Connection: Keep-Alive
Referer: http://www.adulteducation.at/de/struktur/
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)
UA-OS: MacOS
UA-CPU: PPC
Cookie: __utma=160909933.2016430368.1134477507.1144766388.1145348530.13; 
__utmz=160909933.1145348530.13.7.utmccn=(referral)|utmcsr=vhs.or.at|utmcct=/96/|ut
mcmd=referral; __utmb=160909933; __utmc=160909933
Content-type: multipart/form-data; 
boundary=---------------------------168071508944249
Extension: Security/Remote-Passphrase
Content-length: 597
mod_security-message: Access denied with code 403. Error processing 
request body: Multipart: invalid boundary encountered: 
-----------------------------168
071508944249\n [severity "EMERGENCY"]
mod_security-action: 403

28
[POST payload not available]

HTTP/1.1 403 Forbidden
Content-Length: 304
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
--ddfbd861--