SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache mod_rewrite Vendors:   Apache Software Foundation
(OpenBSD Issues Fix) Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016608
SecurityTracker URL:  http://securitytracker.com/id/1016608
CVE Reference:   CVE-2006-3747   (Links to External Site)
Date:  Jul 30 2006
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 1.3.37, 2.0.59
Description:   A vulnerability was reported in Apache in the Rewrite module. A remote user may be able to execute arbitrary code on the target system.

A remote user can trigger an off-by-one error in the processing of certain types of Rewrite rules to cause web server processes to crash or potentially execute arbitrary code.

The impact depends on the manner in which Apache httpd was compiled.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   OpenBSD has issued a fix.

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/004_httpd.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/009_httpd.patch

Vendor URL:  httpd.apache.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (OpenBSD)
Underlying OS Comments:  3.8, 3.9

Message History:   This archive entry is a follow-up to the message listed below.
Jul 28 2006 Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC