CVE-2006-3747

Published: Jul 28, 2006

Modified: Aug 7, 2024

PUBLISHED

Description

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

21266

third-party-advisory

x_refsource_SECUNIA

21307

third-party-advisory

x_refsource_SECUNIA

HPSBMA02250

vendor-advisory

x_refsource_HP

ADV-2006-3995

vdb-entry

x_refsource_VUPEN

apache-modrewrite-offbyone-bo(28063)

vdb-entry

x_refsource_XF

102662

vendor-advisory

x_refsource_SUNALERT

SSRT071293

vendor-advisory

x_refsource_HP

http://www-1.ibm.com/support/docview.wss?uid=swg27007951

x_refsource_CONFIRM

SSRT061265

vendor-advisory

x_refsource_HP

ADV-2006-4300

vdb-entry

x_refsource_VUPEN

20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released

mailing-list

x_refsource_FULLDISC

23028

third-party-advisory

x_refsource_SECUNIA

http://svn.apache.org/viewvc?view=rev&revision=426144

x_refsource_MISC

ADV-2006-3282

vdb-entry

x_refsource_VUPEN

21284

third-party-advisory

x_refsource_SECUNIA

PK29156

vendor-advisory

x_refsource_AIXAPAR

http://kbase.redhat.com/faq/FAQ_68_8653.shtm

x_refsource_MISC

22523

third-party-advisory

x_refsource_SECUNIA

ADV-2008-1246

vdb-entry

x_refsource_VUPEN

HPSBUX02164

vendor-advisory

x_refsource_HP

SSRT090208

vendor-advisory

x_refsource_HP

23260

third-party-advisory

x_refsource_SECUNIA

ADV-2006-3264

vdb-entry

x_refsource_VUPEN

SUSE-SA:2006:043

vendor-advisory

x_refsource_SUSE

ADV-2008-0924

vdb-entry

x_refsource_VUPEN

21313

third-party-advisory

x_refsource_SECUNIA

29849

third-party-advisory

x_refsource_SECUNIA

ADV-2006-4015

vdb-entry

x_refsource_VUPEN

21273

third-party-advisory

x_refsource_SECUNIA

TA08-150A

third-party-advisory

x_refsource_CERT

21478

third-party-advisory

x_refsource_SECUNIA

20060728 Apache mod_rewrite Buffer Overflow Vulnerability

mailing-list

x_refsource_BUGTRAQ

GLSA-200608-01

vendor-advisory

x_refsource_GENTOO

20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released

mailing-list

x_refsource_BUGTRAQ

22368

third-party-advisory

x_refsource_SECUNIA

26329

third-party-advisory

x_refsource_SECUNIA

HPSBUX02145

vendor-advisory

x_refsource_HP

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117

x_refsource_CONFIRM

102663

vendor-advisory

x_refsource_SUNALERT

29420

third-party-advisory

x_refsource_SECUNIA

http://www.apache.org/dist/httpd/Announcement2.0.html

x_refsource_CONFIRM

19204

vdb-entry

x_refsource_BID

21245

third-party-advisory

x_refsource_SECUNIA

ADV-2006-4868

vdb-entry

x_refsource_VUPEN

APPLE-SA-2008-03-18

vendor-advisory

x_refsource_APPLE

HPSBMA02328

vendor-advisory

x_refsource_HP

30430

third-party-advisory

x_refsource_SECUNIA

ADV-2006-4207

vdb-entry

x_refsource_VUPEN

APPLE-SA-2008-05-28

vendor-advisory

x_refsource_APPLE

MDKSA-2006:133

vendor-advisory

x_refsource_MANDRIVA

HPSBOV02683

vendor-advisory

x_refsource_HP

21315

third-party-advisory

x_refsource_SECUNIA

VU#395412

third-party-advisory

x_refsource_CERT-VN

21509

third-party-advisory

x_refsource_SECUNIA

21346

third-party-advisory

x_refsource_SECUNIA

SSRT061202

vendor-advisory

x_refsource_HP

1016601

vdb-entry

x_refsource_SECTRACK

http://docs.info.apple.com/article.html?artnum=307562

x_refsource_CONFIRM

20060728 rPSA-2006-0139-1 httpd mod_ssl

mailing-list

x_refsource_BUGTRAQ

DSA-1131

vendor-advisory

x_refsource_DEBIAN

21247

third-party-advisory

x_refsource_SECUNIA

SSRT061275

vendor-advisory

x_refsource_HP

ADV-2006-3884

vdb-entry

x_refsource_VUPEN

ADV-2008-1697

vdb-entry

x_refsource_VUPEN

20060820 POC & exploit for Apache mod_rewrite off-by-one

mailing-list

x_refsource_BUGTRAQ

https://issues.rpath.com/browse/RPL-538

x_refsource_CONFIRM

22262

third-party-advisory

x_refsource_SECUNIA

OpenPKG-SA-2006.015

vendor-advisory

x_refsource_OPENPKG

1312

third-party-advisory

x_refsource_SREASON

DSA-1132

vendor-advisory

x_refsource_DEBIAN

PK29154

vendor-advisory

x_refsource_AIXAPAR

21241

third-party-advisory

x_refsource_SECUNIA

ADV-2006-3017

vdb-entry

x_refsource_VUPEN

ADV-2007-2783

vdb-entry

x_refsource_VUPEN

20060728 Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability CVE-2006-3747

mailing-list

x_refsource_FULLDISC

USN-328-1

vendor-advisory

x_refsource_UBUNTU

PK27875

vendor-advisory

x_refsource_AIXAPAR

27588

vdb-entry

x_refsource_OSVDB

2006-0044

vendor-advisory

x_refsource_TRUSTIX

22388

third-party-advisory

x_refsource_SECUNIA

21197

third-party-advisory

x_refsource_SECUNIA

[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

mailing-list

x_refsource_MLIST

[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2006-3747

Description

Affected Products

References