(Sun Issues Fix) Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1017049

SecurityTracker URL: http://securitytracker.com/id/1017049

CVE Reference: CVE-2006-3747 (Links to External Site)

Date: Oct 12 2006

Impact: Denial of service via network, Execution of arbitrary code via network, User access via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): prior to 1.3.37, 2.0.59

Description: A vulnerability was reported in Apache in the Rewrite module. A remote user may be able to execute arbitrary code on the target system.

A remote user can trigger an off-by-one error in the processing of certain types of Rewrite rules to cause web server processes to crash or potentially execute arbitrary code.

The impact depends on the manner in which Apache httpd was compiled.

Impact: A remote user can execute arbitrary code on the target system.

Solution: Sun has issued a fix.

SPARC Platform

* Solaris 10 with patch 122911-02 or later

x86 Platform

* Solaris 10 with patch 122912-02 or later

A fix for Solaris 8 and 9 is pending.

The Sun advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102663-1

Vendor URL: httpd.apache.org/ (Links to External Site)

Cause: Boundary error

Underlying OS: UNIX (Solaris - SunOS)

Message History: This archive entry is a follow-up to the message listed below.

Date: Wed, 11 Oct 2006 16:14:06 -0400
Subject: Security Vulnerabilities in the Apache 1.3 Web Server "mod_rewrite" and "mod_imap" Modules



http://sunsolve.sun.com/search/document.do?assetkey=1-26-102663-1

CVE-2005-3352
CVE-2006-3747