Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-3747 — Sensitive Information Exposure in Apache Http Server

CWE-189CWE-200 — Sensitive Information ExposureCWE-22 — Path Traversal17 documents11 sources
Severity
7.6HIGHNVD
GHSA5.0
EPSS
92.6%
top 0.26%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Apache Http ServerCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedJul 28
Latest updateMay 1

Description

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

CVSS vector

AV:N/AC:H/C:C/I:C/A:CExploitability: 4.9 | Impact: 10.0

Affected Packages1 packages

▶NVDapache/http_server1.3.28 — 1.3.37+2

Also affects: Debian Linux 3.1, Ubuntu Linux 5.04, 5.10, 6.06

Patches

Patch: www.apache.org ↗Patch: www.debian.org ↗Patch: www.debian.org ↗

🔴Vulnerability Details

5
GHSA
GHSA-47q7-qpgp-938j: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1↗2022-05-01
▶
GHSA
Mortbay Jetty Discloses JSP Source Code↗2022-05-01
▶
GHSA
Jetty Directory Traversal Vulnerability↗2022-05-01
▶
CVEList
CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1↗2006-07-28
▶
OSV
CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1↗2006-07-28
▶

💥Exploits & PoCs

4
Exploit-DB
Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)↗2010-02-15
▶
Exploit-DB
Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow↗2007-05-26
▶
Exploit-DB
Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow↗2007-04-07
▶
Exploit-DB
Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow↗2006-08-21
▶

📋Vendor Advisories

5
Ubuntu
Apache vulnerability↗2006-07-28
▶
Debian
CVE-2006-3747: apache2 - Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite)...↗2006
▶
Red Hat
jetty: Jetty URL encoded format directory traversal↗2005-11-18
▶
Red Hat
CVE-2006-3747: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1↗
▶
Apache
Apache httpd: CVE-2006-3747↗
▶

💬Community

2
Bugzilla
CVE-2006-3747 needs fixing in httpd for FC6↗2006-08-15
▶
Bugzilla
CVE-2006-3747 mod_rewrite off-by-one↗2006-07-26
▶
CVE-2006-3747 — Sensitive Information Exposure | cvebase