Description
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.0.55-4.1 | — |
| Debian 13 | apache2 | 2.0.55-4.1 | — |
| Debian 12 | apache2 | 2.0.55-4.1 | — |
| Debian 3.1 | apache | 1.3.33-6sarge2 | DSA-1131-1 |
| Debian 3.1 | apache2 | 2.0.54-5sarge1 | DSA-1132-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Module mod_rewrite LDAP Protocol Buffer Overflow
exploit/windows/http/apache_mod_rewrite_ldap
Exploit-DB 4
- Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit) EDB-16752 · remote · Feb 15, 2010 · verified
- Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow EDB-3996 · remote · May 26, 2007 · verified
- Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow EDB-3680 · remote · Apr 7, 2007 · verified
- Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow EDB-2237 · remote · Aug 21, 2006 · verified
GitHub 1 repository
-
defensahacker/CVE-2006-3747 ★ 2 · Nov 26, 2016
Information about my advisory on CVE-2006-3747 (Apache mod_rewrite LDAP off-by-one buffer overflow).. At the time, it was the first public working exploit :)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-1132-1 apache2 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1131-1 apache - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 21266 third-party-advisory
- 21307 third-party-advisory
- HPSBMA02250 vendor-advisory
- ADV-2006-3995 vdb-entry
- apache-modrewrite-offbyone-bo(28063) vdb-entry
- 102662 vendor-advisory
- SSRT071293 vendor-advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg27007951
- SSRT061265 vendor-advisory
- ADV-2006-4300 vdb-entry
- 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released mailing-list
- 23028 third-party-advisory
- http://svn.apache.org/viewvc?view=rev&revision=426144
- ADV-2006-3282 vdb-entry
- 21284 third-party-advisory
- PK29156 vendor-advisory
- http://kbase.redhat.com/faq/FAQ_68_8653.shtm
- 22523 third-party-advisory
- ADV-2008-1246 vdb-entry
- SSRT090208 vendor-advisory
- 23260 third-party-advisory
- ADV-2006-3264 vdb-entry
- SUSE-SA:2006:043 vendor-advisory
- ADV-2008-0924 vdb-entry
- 21313 third-party-advisory
- 29849 third-party-advisory
- ADV-2006-4015 vdb-entry
- 21273 third-party-advisory
- TA08-150A third-party-advisory
- 21478 third-party-advisory
- 20060728 Apache mod_rewrite Buffer Overflow Vulnerability mailing-list
- GLSA-200608-01 vendor-advisory
- 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released mailing-list
- 22368 third-party-advisory
- 26329 third-party-advisory
- HPSBUX02145 vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
- 102663 vendor-advisory
- 29420 third-party-advisory
- http://www.apache.org/dist/httpd/Announcement2.0.html
- 19204 vdb-entry
- 21245 third-party-advisory
- ADV-2006-4868 vdb-entry
- APPLE-SA-2008-03-18 vendor-advisory
- 30430 third-party-advisory
- ADV-2006-4207 vdb-entry
- APPLE-SA-2008-05-28 vendor-advisory
- MDKSA-2006:133 vendor-advisory
- 21315 third-party-advisory
- VU#395412 third-party-advisory
- 21509 third-party-advisory
- 21346 third-party-advisory
- 1016601 vdb-entry
- http://docs.info.apple.com/article.html?artnum=307562
- 20060728 rPSA-2006-0139-1 httpd mod_ssl mailing-list
- DSA-1131 vendor-advisory
- 21247 third-party-advisory
- ADV-2006-3884 vdb-entry
- ADV-2008-1697 vdb-entry
- 20060820 POC & exploit for Apache mod_rewrite off-by-one mailing-list