Advisory Text :  

McAfee, Inc.

McAfee Avert(tm) Labs Security Advisory

Public Release Date: 2006-07-09

Apache 1.3.29/2.X mod_rewrite Buffer Over Vulnerability

CVE-2006-3747

______________________________________________________________________

* Synopsis

Mod_rewrite is an Apache module that can be used to remap requests

based on regular expression matches of the requested URI. A buffer

overflow vulnerability exists when dealing with rewritten URI's that

are prefixed with the LDAP protocol scheme.

Exploitation leads to remote access to the vulnerable machine and

therefore the risk factor is critical.

______________________________________________________________________

* Vulnerable Systems

Apache 1.3.29/mod_rewrite

Apache 2.0.x/mod_rewrite - only 2.0.46 and higher are vulnerable

Apache 2.2.x/mod_rewrite

______________________________________________________________________

* Vulnerability Information

The mod_rewrite module contains an off-by-one buffer overflow

vulnerability when escaping an absolute URI scheme. The vulnerability

occurs within escape_absolute_uri( ) when separating out tokens

within an LDAP URL. Triggering the vulnerability results in a pointer

to user-controlled data to be written outside of the bounds of a

character pointer array, which in many cases can be used to gain

complete control of the affected host.

Note that an LDAP-specific rule does not need to be exist to exploit

the vulnerability. However, a rule must exist with the following

properties:

- A rule must exist where the user can control the initial part of the
rewritten URL

- The rule must not contain a forbidden or gone flag [F or G]

- Rules with "noescape" [NE] flag settings are not affected.

______________________________________________________________________

* Resolution

http://www.apache.org/dist/httpd/Announcement2.2.html

______________________________________________________________________

* Credits

This vulnerability was discovered by Mark Dowd of McAfee Avert Labs.

______________________________________________________________________

______________________________________________________________________

* Legal Notice

Copyright (C) 2006 McAfee, Inc.

The information contained within this advisory is provided for the

convenience of McAfee's customers, and may be redistributed provided

that no fee is charged for distribution and that the advisory is not

modified in any way. McAfee makes no representations or warranties

regarding the accuracy of the information referenced in this document,

or the suitability of that information for your purposes.

McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee,

Inc. and/or its affiliated companies in the United States and/or other

Countries. All other registered and unregistered trademarks in this

document are the sole property of their respective owners.

______________________________________________________________________