McAfee, Inc.
McAfee Avert(tm) Labs Security Advisory
Public Release Date: 2006-07-09
Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability
CVE-2006-3747
______________________________________________________________________
* Synopsis
Mod_rewrite is an Apache module that can be used to remap requests
based on regular expression matches of the requested URI. A buffer
overflow vulnerability exists when dealing with rewritten URI's that
are prefixed with the LDAP protocol scheme.
Exploitation leads to remote access to the vulnerable machine and
therefore the risk factor is critical.
______________________________________________________________________
* Vulnerable Systems
Apache 1.3.29/mod_rewrite
Apache 2.0.x/mod_rewrite - only 2.0.46 and higher are vulnerable
Apache 2.2.x/mod_rewrite
______________________________________________________________________
* Vulnerability Information
The mod_rewrite module contains an off-by-one buffer overflow
vulnerability when escaping an absolute URI scheme. The vulnerability
occurs within escape_absolute_uri( ) when separating out tokens
within an LDAP URL. Triggering the vulnerability results in a pointer
to user-controlled data to be written outside of the bounds of a
character pointer array, which in many cases can be used to gain
complete control of the affected host.
Note that an LDAP-specific rule does not need to be exist to exploit
the vulnerability. However, a rule must exist with the following
properties:
- A rule must exist where the user can control the initial part of the
rewritten URL
- The rule must not contain a forbidden or gone flag [F or G]
- Rules with "noescape" [NE] flag settings are not affected.
______________________________________________________________________
* Resolution
http://www.apache.org/dist/httpd/Announcement2.2.html
______________________________________________________________________
* Credits
This vulnerability was discovered by Mark Dowd of McAfee Avert Labs.
______________________________________________________________________
______________________________________________________________________
* Legal Notice
Copyright (C) 2006 McAfee, Inc.
The information contained within this advisory is provided for the
convenience of McAfee's customers, and may be redistributed provided
that no fee is charged for distribution and that the advisory is not
modified in any way. McAfee makes no representations or warranties
regarding the accuracy of the information referenced in this document,
or the suitability of that information for your purposes.
McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee,
Inc. and/or its affiliated companies in the United States and/or other
Countries. All other registered and unregistered trademarks in this
document are the sole property of their respective owners.
______________________________________________________________________
Best regards,
Dave Marcus, B.A., CCNA, MCSE
Security Research and Communications Manager
McAfee(r) Avert(r) Labs
(443) 321-3771 Office
(443) 668-0048 Mobile
McAfee Threat Center
<http://www.mcafee.com/us/threat_center/default.asp>
McAfee Avert Labs Research Blog <http://www.avertlabs.com/research/blog>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
