CVE-2006-3747
published 2006-07-28CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2…
PriorityP267high7.6CVSS 2.0
AVNACHAuNCCICAC
EXPLOIT
EPSS
96.44%
99.9th percentile
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 1.3.28 < 1.3.37 | 1.3.37 |
| apache | http_server | >= 2.0.46 < 2.0.59 | 2.0.59 |
| apache | http_server | >= 2.2.0 < 2.2.3 | 2.2.3 |
| apache | httpd | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | apache2 | < apache2 2.0.55-4.1 (bookworm) | apache2 2.0.55-4.1 (bookworm) |
| debian | debian_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41
- →Exploit requests contain 'ldap://' in the URI path sent to Apache mod_rewrite; look for HTTP GET requests with 'ldap://' in the URL path, especially combined with NOP sleds (%90) or encoded shellcode characters. ↗
- →The exploit requires 'RewriteEngine on' and a specific RewriteRule to be configured on the target Apache server; detection should focus on HTTP requests with ldap:// scheme in the URI path routed through mod_rewrite. ↗
- →Payload bad characters for this exploit are null byte, newline, carriage return, and space (\x00\x0a\x0d\x20); encoded payload uses AlphanumUpper encoding — look for long alphanumeric strings in the URI following the ldap:// trigger. ↗
- →Vulnerable Apache versions are 1.3.29-36, 2.0.47-58, and 2.2.1-2; inventory and alert on these specific version strings in HTTP Server response headers. ↗
- ·Exploitation requires RewriteEngine to be enabled and a specific RewriteRule to be present in the Apache configuration; servers without mod_rewrite or without a matching RewriteRule are not exploitable. ↗
- ·The Metasploit module and public exploits currently only support Windows-based Apache installations; Linux exploitation may require different shellcode addresses and offsets. ↗
CVSS provenance
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa5.0MEDIUM
osv7.6HIGH
vendor_apache7.6HIGH
vendor_debian7.6MEDIUM
vendor_redhat7.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-47q7-qpgp-938j: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1
ghsa_unreviewed·2022-05-01
CVE-2006-3747 [HIGH] GHSA-47q7-qpgp-938j: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
GHSA
Mortbay Jetty Discloses JSP Source Code
ghsa·2022-05-01·CVSS 5.0
CVE-2005-3747 [MEDIUM] CWE-200 Mortbay Jetty Discloses JSP Source Code
Mortbay Jetty Discloses JSP Source Code
Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash (`%5C`) characters. NOTE: this might be the same issue as CVE-2006-2758.
GHSA
Jetty Directory Traversal Vulnerability
ghsa·2022-05-01·CVSS 5.0
CVE-2006-2758 [MEDIUM] CWE-22 Jetty Directory Traversal Vulnerability
Jetty Directory Traversal Vulnerability
Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a `%2e%2e%5c` (encoded `../`) in the URL. NOTE: this might be the same issue as CVE-2005-3747.
OSV
CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1
osv·2006-07-28·CVSS 7.6
CVE-2006-3747 [HIGH] CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Ubuntu
Apache vulnerability
vendor_ubuntu·2006-07-28
CVE-2006-3747 Apache vulnerability
Title: Apache vulnerability
Summary: Apache vulnerability
Mark Dowd discovered an off-by-one buffer overflow in the mod_rewrite
module's ldap scheme handling. On systems which activate
"RewriteEngine on", a remote attacker could exploit certain rewrite
rules to crash Apache, or potentially even execute arbitrary code
(this has not been verified).
"RewriteEngine on" is disabled by default. Systems which have this
directive disabled are not affected at all.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Debian
CVE-2006-3747: apache2 - Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite)...
vendor_debian·2006·CVSS 7.6
CVE-2006-3747 [HIGH] CVE-2006-3747: apache2 - Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite)...
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Scope: local
bookworm: resolved (fixed in 2.0.55-4.1)
bullseye: resolved (fixed in 2.0.55-4.1)
forky: resolved (fixed in 2.0.55-4.1)
sid: resolved (fixed in 2.0.55-4.1)
trixie: resolved (fixed in 2.0.55-4.1)
Red Hat
jetty: Jetty URL encoded format directory traversal
vendor_redhat·2005-11-18·CVSS 5.0
CVE-2006-2758 [MEDIUM] CWE-22 jetty: Jetty URL encoded format directory traversal
jetty: Jetty URL encoded format directory traversal
Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL. NOTE: this might be the same issue as CVE-2005-3747.
A flaw was found in Jetty. This issue could allow a remote attacker to send a specially-crafted URL request containing hexadecimal URL encoded "dot-dot" sequences (%2e%2e%5c) to traverse directories and view files and folders outside of the web root directory.
Package: jetty (Red Hat Enterprise Linux 7) - Not affected
Red Hat
CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1
vendor_redhat·CVSS 7.6
CVE-2006-3747 [HIGH] CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Statement: The ability to exploit this issue is dependent on the stack layout for a particular compiled version of mod_rewrite. If the compiler has added padding to the stack immediately after the buffer being overwritten, this issue can not be exploited, and Apache httpd will continue operating normally.
The Red Hat Security Response Team analyzed Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4 binaries for all
Apache
Apache httpd: CVE-2006-3747
vendor_apache·CVSS 7.6
CVE-2006-3747 [HIGH] Apache httpd: CVE-2006-3747
Apache httpd: CVE-2006-3747
An off-by-one flaw exists in the Rewrite module, mod_rewrite. Depending on the manner in which Apache httpd was compiled, this software defect may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files, could be triggered remotely. For vulnerable builds, the nature of the vulnerability can be denial of service (crashing of web server processes) or potentially allow arbitrary code execution. Reported to security team 2006-07-21 Issue public 2006-07-27 Update 2.2.3 released 2006-07-27 Update 2.0.59 released 2006-07-27 Update 1.3.37 released 2006-07-27 Affects 2.2.2, 2.2.0, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 1.3.36, 1.3.35, 1.3.34, 1.3.33, 1.3.32,
No detection rules found.
Exploit-DB
Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)
exploitdb·2010-02-15
CVE-2006-3747 Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)
Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)
---
##
# $Id: apache_mod_rewrite_ldap.rb 8498 2010-02-15 00:48:03Z hdm $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Apache module mod_rewrite LDAP protocol Buffer Overflow',
'Description' => %q{
This module exploits the mod_rewrite LDAP protocol scheme handling
flaw discovered by Mark Dowd, which produces an off-by-one overflow.
Apache versions 1.3.29-36, 2.0.47-58, and 2.2.1-2 are vulnerable.
This module requires REWRITEPATH to be set accurately. In addition,
the target
Exploit-DB
Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow
exploitdb·2007-05-26
CVE-2006-3747 Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow
Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow
---
/*
apache mod rewrite exploit (win32)
By: fabio/b0x (oc-192, old CoTS member)
Vuln details: http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded
Code: bind shell on port 4445, tested on apache 2.0.58 with mod_rewrite (windows 2003)
original exploit (http://milw0rm.com/exploits/3680) only had a call back on 192.168.0.1, also
was a little buggy, so shellcode was rewriten, thanks to http://metasploit.com/
Usage: ./apache hostname rewrite_path
Greetings: caffeine, raver, psikoma, cumatru, insomnia, teddym6, googleman, ares, trickster, rebel and Pentaguard
Example: ./apache 192.168.0.253 test
[+]Preparing payload
[+]Connecting...
[+]Connected
[+]Sending...
[+]Sent
[+]Starting second stage...
[+]Connecting..
Exploit-DB
Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow
exploitdb·2007-04-07·CVSS 7.6
CVE-2006-3747 [HIGH] Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow
Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow
---
#!/bin/sh
# Exploit for Apache mod_rewrite off-by-one(Win32).
#
# by axis
# http://www.ph4nt0m.org
# 2007-04-06
#
# Tested on Apache 2.0.58 (Win32)
# Windows2003 CN SP1
#
# Vulnerable Apache Versions:
# * 1.3 branch: >1.3.28 and 2.0.46 and 2.2.0 and
# 2006-08-20
# http://www.milw0rm.com/exploits/2237
#
#
#
# to successfully exploit the vuln,there are some conditions
# http://www.vuxml.org/freebsd/dc8c08c7-1e7c-11db-88cf-000c6ec775d9.html
#
#
# some compilers added padding to the stack, so they could not be exploited,like gcc under redhat
#
# for more details about the vuln please see:
# http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded
#
#
# no opcodes needed under windows!
# it will directly run our s
Exploit-DB
Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow
exploitdb·2006-08-21·CVSS 7.6
CVE-2006-3747 [HIGH] Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow
Apache
# 2006-08-20
#
# Thx to xuso for help me with the shellcode.
#
# I suppose that you've the "RewriteRule kung/(.*) $1" rule if not
# you must recalculate adressess.
#
# Shellcode is based on Taeho Oh bindshell on port 30464 and modified
# for avoiding apache url-escape.. Take a look is quite nice ;)
#
# Shellcode address in heap memory on apache 1.3.34 (debian sarge) is at
# 0x0834ae77 for any other version/system find it.
#
# Gulcas rulez :P
echo -e "mod_rewrite apache off-by-one overflow"
echo "by jack \n\n"
if [ $# -ne 1 ] ; then
echo "Usage: $0 webserver"
exit
fi
host=$1
echo -ne "GET /kung/ldap://localhost/`perl -e 'print "%90"x128'`%89%e6\
%31%c0%31%db%89%f1%b0%02%89%06%b0%01%89%46%04%b0%06%89%46%08%b0%66%b3\
%01%cd%80%89%06%b0%02%66%89%46%0c%b0%77%66%89%46%0e%8d%46%0c%89%4
Metasploit
Apache Module mod_rewrite LDAP Protocol Buffer Overflow
metasploit
Apache Module mod_rewrite LDAP Protocol Buffer Overflow
Apache Module mod_rewrite LDAP Protocol Buffer Overflow
This module exploits the mod_rewrite LDAP protocol scheme handling flaw discovered by Mark Dowd, which produces an off-by-one overflow. Apache versions 1.3.29-36, 2.0.47-58, and 2.2.1-2 are vulnerable. This module requires REWRITEPATH to be set accurately. In addition, the target must have 'RewriteEngine on' configured, with a specific 'RewriteRule' condition enabled to allow for exploitation. The flaw affects multiple platforms, however this module currently only supports Windows based installations.
Bugzilla
CVE-2006-3747 needs fixing in httpd for FC6
bugzilla·2006-08-15·CVSS 7.6
CVE-2006-3747 [HIGH] CVE-2006-3747 needs fixing in httpd for FC6
CVE-2006-3747 needs fixing in httpd for FC6
CVE-2006-3747 was fixed in httpd 2.2.3 upstream but didn't make it into
FC6test2. This is a tracking bug for this issue.
Discussion:
2.2.3 shipped in FC6 final.
Bugzilla
CVE-2006-3747 mod_rewrite off-by-one
bugzilla·2006-07-26·CVSS 7.6
CVE-2006-3747 [HIGH] CVE-2006-3747 mod_rewrite off-by-one
CVE-2006-3747 mod_rewrite off-by-one
Mark Dowd of McAfee Avert Labs reported an off-by-one security problem in
the ldap scheme handling of the mod_rewrite module. Where RewriteEngine is
enabled, and for certain RewriteRules, this could lead to a pointer being
written out of bounds. (CVE-2006-3747)
The ability to exploit this issue is dependent on the stack layout for a
particular compiled version of mod_rewrite. If the compiler has added
padding to the stack immediately after the buffer being overwritten, it
will not be possible to exploit this issue, and Apache httpd will continue
operating normally.
The Red Hat Security Response Team has analyzed Red Hat Enterprise Linux 3
i386 and x86_64, Red Hat Enterprise Linux 4 i386 and x86_64 binaries as
shipped by Red Hat and determined that th
arXiv
Stochastic Simulation Techniques for Inference and Sensitivity Analysis of Bayesian Attack Graphs
arxiv_fulltext·2021-03-18
Stochastic Simulation Techniques for Inference and Sensitivity Analysis of Bayesian Attack Graphs
Stochastic Simulation Techniques for Inference and Sensitivity Analysis of Bayesian Attack Graphs
Stochastic Simulation for Bayesian Attack Graphs
Isaac Matthews1,2
Sadegh Soudjani1
Aad van Moorsel1
I. Matthews et al.
School of Computing, Newcastle University, United Kingdom
[email protected]
## Abstract
A vulnerability scan combined with information about a computer network can be used to create an attack graph, a model of how the elements of a network could be used in an attack to reach specific states or goals in the network. These graphs can be understood probabilistically by turning them into Bayesian attack graphs, making it possible to quantitatively analyse the security of large networks. In the event of an attack, probabilities on the graph change depending on th
arXiv
Cyclic Bayesian Attack Graphs: A Systematic Computational Approach
arxiv_fulltext·2020-05-13
Cyclic Bayesian Attack Graphs: A Systematic Computational Approach
Cyclic Bayesian Attack Graphs: A Systematic
Computational Approach
Isaac Matthews
Newcastle University
Newcastle upon Tyne, U.K.
[email protected]
John Mace
Newcastle University
Newcastle upon Tyne, U.K.
Sadegh Soudjani
Newcastle University
Newcastle upon Tyne, U.K.
Aad van Moorsel
Newcastle University
Newcastle upon Tyne, U.K.
## Abstract
Attack graphs are commonly used to analyse the security of medium-sized to large networks. Based on a scan of the network and likelihood information of vulnerabilities, attack graphs can be transformed into Bayesian Attack Graphs (BAGs). These BAGs are used to evaluate how security controls affect a network and how changes in topology affect security.
A challenge with these automatically generated BAGs is that cycles arise naturally,
http://docs.info.apple.com/article.html?artnum=307562http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449http://kbase.redhat.com/faq/FAQ_68_8653.shtmhttp://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048267.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048271.htmlhttp://lwn.net/Alerts/194228/http://marc.info/?l=bugtraq&m=130497311408250&w=2http://secunia.com/advisories/21197http://secunia.com/advisories/21241http://secunia.com/advisories/21245http://secunia.com/advisories/21247http://secunia.com/advisories/21266http://secunia.com/advisories/21273http://secunia.com/advisories/21284http://secunia.com/advisories/21307http://secunia.com/advisories/21313http://secunia.com/advisories/21315http://secunia.com/advisories/21346http://secunia.com/advisories/21478http://secunia.com/advisories/21509http://secunia.com/advisories/22262http://secunia.com/advisories/22368http://secunia.com/advisories/22388http://secunia.com/advisories/22523http://secunia.com/advisories/23028http://secunia.com/advisories/23260http://secunia.com/advisories/26329http://secunia.com/advisories/29420http://secunia.com/advisories/29849http://secunia.com/advisories/30430http://security.gentoo.org/glsa/glsa-200608-01.xmlhttp://securityreason.com/securityalert/1312http://securitytracker.com/id?1016601http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-102663-1http://svn.apache.org/viewvc?view=rev&revision=426144http://www-1.ibm.com/support/docview.wss?uid=swg1PK29154http://www-1.ibm.com/support/docview.wss?uid=swg1PK29156http://www-1.ibm.com/support/docview.wss?uid=swg24013080http://www-1.ibm.com/support/docview.wss?uid=swg27007951http://www.apache.org/dist/httpd/Announcement2.0.htmlhttp://www.debian.org/security/2006/dsa-1131http://www.debian.org/security/2006/dsa-1132http://www.kb.cert.org/vuls/id/395412http://www.mandriva.com/security/advisories?name=MDKSA-2006:133http://www.novell.com/linux/security/advisories/2006_43_apache.htmlhttp://www.openpkg.org/security/advisories/OpenPKG-SA-2006.015-apache.htmlhttp://www.osvdb.org/27588http://www.securityfocus.com/archive/1/441485/100/0/threadedhttp://www.securityfocus.com/archive/1/441487/100/0/threadedhttp://www.securityfocus.com/archive/1/441526/100/200/threadedhttp://www.securityfocus.com/archive/1/443870/100/0/threadedhttp://www.securityfocus.com/archive/1/445206/100/0/threadedhttp://www.securityfocus.com/archive/1/450321/100/0/threadedhttp://www.securityfocus.com/bid/19204http://www.ubuntu.com/usn/usn-328-1http://www.us-cert.gov/cas/techalerts/TA08-150A.htmlhttp://www.vupen.com/english/advisories/2006/3017http://www.vupen.com/english/advisories/2006/3264http://www.vupen.com/english/advisories/2006/3282http://www.vupen.com/english/advisories/2006/3884http://www.vupen.com/english/advisories/2006/3995http://www.vupen.com/english/advisories/2006/4015http://www.vupen.com/english/advisories/2006/4207http://www.vupen.com/english/advisories/2006/4300http://www.vupen.com/english/advisories/2006/4868http://www.vupen.com/english/advisories/2007/2783http://www.vupen.com/english/advisories/2008/0924/referenceshttp://www.vupen.com/english/advisories/2008/1246/referenceshttp://www.vupen.com/english/advisories/2008/1697http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117https://exchange.xforce.ibmcloud.com/vulnerabilities/28063https://issues.rpath.com/browse/RPL-538https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttp://docs.info.apple.com/article.html?artnum=307562http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449http://kbase.redhat.com/faq/FAQ_68_8653.shtmhttp://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048267.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048271.htmlhttp://lwn.net/Alerts/194228/http://marc.info/?l=bugtraq&m=130497311408250&w=2
+ 80 more references
2006-07-28
Published