lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <146DCEAE811AC94D96510685EF2F92B4017FB718@dalexmb3.corp.nai.org>
Date: Fri, 28 Jul 2006 10:01:25 -0500
From: <David_Marcus@...fee.com>
To: <full-disclosure@...ts.grok.org.uk>
Cc: Monty_Ijzerman@...fee.com, Mark_Dowd@...fee.com
Subject: Apache 1.3.29/2.X mod_rewrite Buffer Overflow
	Vulnerability CVE-2006-3747

McAfee, Inc.
McAfee Avert(tm) Labs Security Advisory
Public Release Date: 2006-07-09

Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability

CVE-2006-3747
______________________________________________________________________

* Synopsis

Mod_rewrite is an Apache module that can be used to remap requests 
based on regular expression matches of the requested URI. A buffer 
overflow vulnerability exists when dealing with rewritten URI's that 
are prefixed with the LDAP protocol scheme.  

Exploitation leads to remote access to the vulnerable machine and 
therefore the risk factor is critical.

______________________________________________________________________

* Vulnerable Systems

Apache 1.3.29/mod_rewrite
Apache 2.0.x/mod_rewrite - only 2.0.46 and higher are vulnerable
Apache 2.2.x/mod_rewrite

______________________________________________________________________

* Vulnerability Information

The mod_rewrite module contains an off-by-one buffer overflow 
vulnerability when escaping an absolute URI scheme. The vulnerability 
occurs within escape_absolute_uri( ) when separating out tokens 
within an LDAP URL. Triggering the vulnerability results in a pointer 
to user-controlled data to be written outside of the bounds of a 
character pointer array, which in many cases can be used to gain 
complete control of the affected host.

Note that an LDAP-specific rule does not need to be exist to exploit 
the vulnerability. However, a rule must exist with the following 
properties:

- A rule must exist where the user can control the initial part of the
rewritten URL
- The rule must not contain a forbidden or gone flag [F or G]
- Rules with "noescape" [NE] flag settings are not affected.


______________________________________________________________________

* Resolution

http://www.apache.org/dist/httpd/Announcement2.2.html

______________________________________________________________________

* Credits

This vulnerability was discovered by Mark Dowd of McAfee Avert Labs.

______________________________________________________________________

______________________________________________________________________

* Legal Notice

Copyright (C) 2006 McAfee, Inc.
The information contained within this advisory is provided for the
convenience of McAfee's customers, and may be redistributed provided
that no fee is charged for distribution and that the advisory is not
modified in any way. McAfee makes no representations or warranties
regarding the accuracy of the information referenced in this document,
or the suitability of that information for your purposes.

McAfee, Inc. and McAfee Avert Labs are registered Trademarks of McAfee,
Inc. and/or its affiliated companies in the United States and/or other
Countries. All other registered and unregistered trademarks in this
document are the sole property of their respective owners.

______________________________________________________________________


Best regards,

Dave Marcus, B.A., CCNA, MCSE
Security Research and Communications Manager
McAfee(r) Avert(r) Labs
(443) 321-3771 Office
(443) 668-0048 Mobile
McAfee Threat Center
<http://www.mcafee.com/us/threat_center/default.asp> 
McAfee Avert Labs Research Blog <http://www.avertlabs.com/research/blog>



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ