bugtraq - Apache mod_rewrite Buffer Overflow Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060728145039.1529.qmail@securityfocus.com>
Date: 28 Jul 2006 14:50:39 -0000
From: Avert@...rtlabs.com
To: bugtraq@...urityfocus.com
Subject: Apache mod_rewrite Buffer Overflow Vulnerability

McAfee, Inc.
McAfee Avert(tm) Labs Security Advisory
Public Release Date: 2006-07-09

Apache 1.3.29/2.X mod_rewrite Buffer Over Vulnerability

CVE-2006-3747
______________________________________________________________________

* Synopsis

Mod_rewrite is an Apache module that can be used to remap requests 
based on regular expression matches of the requested URI. A buffer 
overflow vulnerability exists when dealing with rewritten URI's that 
are prefixed with the LDAP protocol scheme.  

Exploitation leads to remote access to the vulnerable machine and 
therefore the risk factor is critical.

______________________________________________________________________

* Vulnerable Systems

Apache 1.3.29/mod_rewrite
Apache 2.0.x/mod_rewrite - only 2.0.46 and higher are vulnerable
Apache 2.2.x/mod_rewrite

______________________________________________________________________

* Vulnerability Information

The mod_rewrite module contains an off-by-one buffer overflow 
vulnerability when escaping an absolute URI scheme. The vulnerability 
occurs within escape_absolute_uri( ) when separating out tokens 
within an LDAP URL. Triggering the vulnerability results in a pointer 
to user-controlled data to be written outside of the bounds of a 
character pointer array, which in many cases can be used to gain 
complete control of the affected host.

Note that an LDAP-specific rule does not need to be exist to exploit 
the vulnerability. However, a rule must exist with the following 
properties:

- A rule must exist where the user can control the initial part of the rewritten URL
- The rule must not contain a forbidden or gone flag [F or G]
- Rules with "noescape" [NE] flag settings are not affected.

______________________________________________________________________

* Resolution

http://www.apache.org/dist/httpd/Announcement2.2.html

______________________________________________________________________

* Credits

This vulnerability was discovered by Mark Dowd of McAfee Avert Labs.

______________________________________________________________________

______________________________________________________________________

* Legal Notice

Copyright (C) 2006 McAfee, Inc.
The information contained within this advisory is provided for the
convenience of McAfee's customers, and may be redistributed provided
that no fee is charged for distribution and that the advisory is not
modified in any way. McAfee makes no representations or warranties
regarding the accuracy of the information referenced in this document,
or the suitability of that information for your purposes.

McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee,
Inc. and/or its affiliated companies in the United States and/or other
Countries. All other registered and unregistered trademarks in this
document are the sole property of their respective owners.

______________________________________________________________________