Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Jul 28, 2006 |
| Apache Httpd 1_3_x Mod_rewrite Off By One Error | — | — | Aug 16, 2010 | Jul 28, 2006 |
| Apache Httpd 2_2_x Mod_rewrite Off By One Error | — | — | Aug 16, 2010 | Jul 28, 2006 |
| Apple Osx Apache | — | Apply OS X security update 2008-003 | Dec 16, 2011 | Jul 28, 2006 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Jul 28, 2006 |
| Freebsd | — | Upgrade apache_fpUpgrade apache+mod_ssl+mod_deflate+ipv6Upgrade apacheUpgrade apache+mod_ssl+mod_deflateUpgrade apache+sslUpgrade apache+mod_ssl+mod_snmpUpgrade apache+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accelUpgrade apache+mod_perlUpgrade ru-apacheUpgrade apache+mod_ssl+mod_snmp+mod_deflateUpgrade ru-apache+mod_sslUpgrade apache+mod_ssl+mod_accel+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_accel+mod_deflateUpgrade apache+mod_ssl+mod_snmp+mod_accel+ipv6Upgrade apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6Upgrade apache+mod_ssl+mod_accelUpgrade apache+mod_ssl+mod_accel+mod_deflate+ipv6Upgrade apache+mod_sslUpgrade apache+mod_ssl+ipv6 | Dec 10, 2025 | Jul 28, 2006 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Jul 28, 2006 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Jul 28, 2006 |
| Suse | — | Upgrade php5-xmlrpcUpgrade php5-sysvshmUpgrade php5-opensslUpgrade php5-iconvUpgrade php5-xslUpgrade php5-mbstringUpgrade php5-gettextUpgrade php5-pspellUpgrade apacheUpgrade php5-domUpgrade php5-exifUpgrade apache2-develUpgrade php5-dbaseUpgrade php5-gdUpgrade php5-wddxUpgrade apache2-preforkUpgrade php5-pearUpgrade mod_sslUpgrade php5-mysqliUpgrade php5-socketsUpgrade php5-sysvmsgUpgrade php5-imapUpgrade apache2Upgrade apache2-mod_php5Upgrade php5-ctypeUpgrade php5-posixUpgrade php5-zlibUpgrade apache2-workerUpgrade php5-mysqlUpgrade php5-bcmathUpgrade php5-sqliteUpgrade php5-mcryptUpgrade php5-develUpgrade php5-sysvsemUpgrade php5-fileproUpgrade php5-pdoUpgrade apache2-docUpgrade php5-bz2Upgrade php5-soapUpgrade php5-calendarUpgrade php5-mhashUpgrade php5-dbaUpgrade php5-pgsqlUpgrade php5-ncursesUpgrade apache2-example-pagesUpgrade php5-snmpUpgrade php5-gmpUpgrade php5-fastcgiUpgrade php5-shmopUpgrade php5-xmlreaderUpgrade php5-odbcUpgrade php5-ldapUpgrade php5-tokenizerUpgrade php5-pcntlUpgrade php5-curlUpgrade php5-ftp | Feb 17, 2015 | Jul 28, 2006 |
| Ubuntu | — | Upgrade apache2-mpm-perchildUpgrade apache2-mpm-threadpoolUpgrade apache2-mpm-workerUpgrade apache2-mpm-prefork | Nov 8, 2024 | Jul 28, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub