CVE-2006-3747
- State
- Published
- Severity
- Not scored
- Published
- Jul 28, 2006
- Updated
- Aug 7, 2024
- Reserved
- Jul 20, 2006
Description
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 21266third-party-advisory
- 21307third-party-advisory
- HPSBMA02250vendor-advisory
- ADV-2006-3995vdb-entry
- apache-modrewrite-offbyone-bo(28063)vdb-entry
- 102662vendor-advisory
- SSRT071293vendor-advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg27007951
- SSRT061265vendor-advisory
- ADV-2006-4300vdb-entry
- 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Releasedmailing-list
- 23028third-party-advisory
- http://svn.apache.org/viewvc?view=rev&revision=426144
- ADV-2006-3282vdb-entry
- 21284third-party-advisory
- PK29156vendor-advisory
- http://kbase.redhat.com/faq/FAQ_68_8653.shtm
- 22523third-party-advisory
- ADV-2008-1246vdb-entry
- SSRT090208vendor-advisory
- 23260third-party-advisory
- ADV-2006-3264vdb-entry
- SUSE-SA:2006:043vendor-advisory
- ADV-2008-0924vdb-entry
- 21313third-party-advisory
- 29849third-party-advisory
- ADV-2006-4015vdb-entry
- 21273third-party-advisory
- TA08-150Athird-party-advisory
- 21478third-party-advisory
- 20060728 Apache mod_rewrite Buffer Overflow Vulnerabilitymailing-list
- GLSA-200608-01vendor-advisory
- 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Releasedmailing-list
- 22368third-party-advisory
- 26329third-party-advisory
- HPSBUX02145vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
- 102663vendor-advisory
- 29420third-party-advisory
- http://www.apache.org/dist/httpd/Announcement2.0.html
- 19204vdb-entry
- 21245third-party-advisory
- ADV-2006-4868vdb-entry
- APPLE-SA-2008-03-18vendor-advisory
- 30430third-party-advisory
- ADV-2006-4207vdb-entry
- APPLE-SA-2008-05-28vendor-advisory
- MDKSA-2006:133vendor-advisory
- 21315third-party-advisory
- VU#395412third-party-advisory
- 21509third-party-advisory
- 21346third-party-advisory
- 1016601vdb-entry
- http://docs.info.apple.com/article.html?artnum=307562
- 20060728 rPSA-2006-0139-1 httpd mod_sslmailing-list
- DSA-1131vendor-advisory
- 21247third-party-advisory
- ADV-2006-3884vdb-entry
- ADV-2008-1697vdb-entry
- 20060820 POC & exploit for Apache mod_rewrite off-by-onemailing-list
- https://issues.rpath.com/browse/RPL-538
- 22262third-party-advisory
- OpenPKG-SA-2006.015vendor-advisory
- 1312third-party-advisory
- DSA-1132vendor-advisory
- PK29154vendor-advisory
- 21241third-party-advisory
- ADV-2006-3017vdb-entry
- ADV-2007-2783vdb-entry
- 20060728 Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability CVE-2006-3747mailing-list
- USN-328-1vendor-advisory
- PK27875vendor-advisory
- 27588vdb-entry
- 2006-0044vendor-advisory
- 22388third-party-advisory
- 21197third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.