exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

modrewrite.txt

modrewrite.txt
Posted Aug 3, 2006
Authored by Mark Dowd | Site avertlabs.com

Mod_rewrite is an Apache module that can be used to remap requests based on regular expression matches of the requested URI. A buffer overflow vulnerability exists when dealing with rewritten URI's that are prefixed with the LDAP protocol scheme.

tags | advisory, overflow, protocol
advisories | CVE-2006-3747
SHA-256 | 89573f59a369c297fe3a2e50bec303dac0dec1ddee0ba1457f1cfd898bbab15d

modrewrite.txt

Change Mirror Download
McAfee, Inc.
McAfee Avert(tm) Labs Security Advisory
Public Release Date: 2006-07-09

Apache 1.3.29/2.X mod_rewrite Buffer Over Vulnerability

CVE-2006-3747
______________________________________________________________________

* Synopsis

Mod_rewrite is an Apache module that can be used to remap requests
based on regular expression matches of the requested URI. A buffer
overflow vulnerability exists when dealing with rewritten URI's that
are prefixed with the LDAP protocol scheme.

Exploitation leads to remote access to the vulnerable machine and
therefore the risk factor is critical.

______________________________________________________________________

* Vulnerable Systems

Apache 1.3.29/mod_rewrite
Apache 2.0.x/mod_rewrite - only 2.0.46 and higher are vulnerable
Apache 2.2.x/mod_rewrite

______________________________________________________________________

* Vulnerability Information

The mod_rewrite module contains an off-by-one buffer overflow
vulnerability when escaping an absolute URI scheme. The vulnerability
occurs within escape_absolute_uri( ) when separating out tokens
within an LDAP URL. Triggering the vulnerability results in a pointer
to user-controlled data to be written outside of the bounds of a
character pointer array, which in many cases can be used to gain
complete control of the affected host.

Note that an LDAP-specific rule does not need to be exist to exploit
the vulnerability. However, a rule must exist with the following
properties:

- A rule must exist where the user can control the initial part of the rewritten URL
- The rule must not contain a forbidden or gone flag [F or G]
- Rules with "noescape" [NE] flag settings are not affected.


______________________________________________________________________

* Resolution

http://www.apache.org/dist/httpd/Announcement2.2.html

______________________________________________________________________

* Credits

This vulnerability was discovered by Mark Dowd of McAfee Avert Labs.

______________________________________________________________________

______________________________________________________________________

* Legal Notice

Copyright (C) 2006 McAfee, Inc.
The information contained within this advisory is provided for the
convenience of McAfee's customers, and may be redistributed provided
that no fee is charged for distribution and that the advisory is not
modified in any way. McAfee makes no representations or warranties
regarding the accuracy of the information referenced in this document,
or the suitability of that information for your purposes.

McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee,
Inc. and/or its affiliated companies in the United States and/or other
Countries. All other registered and unregistered trademarks in this
document are the sole property of their respective owners.

______________________________________________________________________

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close