Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Jul 28, 2006 |
| Apache Httpd 1_3_x Mod_rewrite Off By One Error | — | — | Aug 16, 2010 | Jul 28, 2006 |
| Apache Httpd 2_2_x Mod_rewrite Off By One Error | — | — | Aug 16, 2010 | Jul 28, 2006 |
| Apple Osx Apache | — | Apply OS X security update 2008-003 | Dec 16, 2011 | Jul 28, 2006 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 28, 2006 |
| Freebsd | — | Upgrade apache+mod_ssl+mod_snmp+mod_accelUpgrade apache+mod_perlUpgrade apache+mod_ssl+mod_deflateUpgrade apache+mod_ssl+mod_snmpUpgrade apache+ipv6Upgrade apache+mod_ssl+mod_deflate+ipv6Upgrade apache+sslUpgrade apache_fpUpgrade apacheUpgrade apache+mod_ssl+mod_snmp+mod_deflateUpgrade apache+mod_sslUpgrade ru-apacheUpgrade apache+mod_ssl+mod_accel+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+ipv6Upgrade apache+mod_ssl+mod_accel+ipv6Upgrade apache+mod_ssl+mod_accel+mod_deflateUpgrade apache+mod_ssl+mod_accelUpgrade apache+mod_ssl+mod_snmp+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6Upgrade ru-apache+mod_sslUpgrade apache+mod_ssl+ipv6 | Dec 10, 2025 | Jul 28, 2006 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Jul 28, 2006 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Jul 28, 2006 |
| Suse | — | Upgrade php5-tokenizerUpgrade php5-bz2Upgrade php5-dbaUpgrade php5-odbcUpgrade php5-shmopUpgrade php5-sysvsemUpgrade php5-fastcgiUpgrade php5-mcryptUpgrade php5-calendarUpgrade php5-bcmathUpgrade php5-fileproUpgrade apache2-docUpgrade php5-curlUpgrade php5-pdoUpgrade php5-ftpUpgrade php5-ldapUpgrade php5-sqliteUpgrade php5-soapUpgrade apache2-example-pagesUpgrade php5-develUpgrade php5-gmpUpgrade php5-mysqlUpgrade php5-pgsqlUpgrade php5-xmlreaderUpgrade php5-ncursesUpgrade php5-pcntlUpgrade php5-snmpUpgrade php5-mhashUpgrade php5-mbstringUpgrade php5-mysqliUpgrade php5-xmlrpcUpgrade apache2-mod_php5Upgrade php5-imapUpgrade php5-sysvshmUpgrade php5-zlibUpgrade apache2-preforkUpgrade php5-ctypeUpgrade php5-sysvmsgUpgrade php5-pspellUpgrade php5-socketsUpgrade apache2Upgrade php5-pearUpgrade php5-posixUpgrade php5-iconvUpgrade php5-wddxUpgrade php5-dbaseUpgrade apache2-develUpgrade php5-xslUpgrade apache2-workerUpgrade php5-exifUpgrade php5-domUpgrade mod_sslUpgrade php5-gdUpgrade apacheUpgrade php5-opensslUpgrade php5-gettext | Feb 17, 2015 | Jul 28, 2006 |
| Ubuntu | — | Upgrade apache2-mpm-preforkUpgrade apache2-mpm-workerUpgrade apache2-mpm-threadpoolUpgrade apache2-mpm-perchild | Nov 8, 2024 | Jul 28, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub