(HP Issues Fix for OpenView) Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019907 |
|
SecurityTracker URL: http://securitytracker.com/id/1019907
|
|
CVE Reference:
CVE-2006-3747
(Links to External Site)
|
Date: Apr 18 2008
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 6.41, 7.01, 7.51
|
Description:
A vulnerability was reported in Apache in the Rewrite module. A remote user may be able to execute arbitrary code on the target system. HP OpenView Network Node Manager is affected.
A remote user can trigger an off-by-one error in the processing of certain types of Rewrite rules to cause web server processes to crash or potentially execute arbitrary code.
The impact depends on the manner in which Apache httpd was compiled.
|
Impact:
A remote user can execute arbitrary code on the target system.
|
Solution:
HP has issued a fix for OpenView Network Node Manager, which is affected by this vulnerability.
OV NNM v7.51:
HP-UX (IA)
PHSS_36386 or subsequent
HP-UX (PA)
PHSS_36385 or subsequent
Solaris
PSOV_03479 or subsequent
Linux RedHatAS2.1
LXOV_00052 or subsequent
OV NNM v7.01:
HP-UX (PA)
PHSS_36773 or subsequent
Solaris
PSOV_03480 or subsequent
OV NNM v6.41:
HP-UX (PA)
PHSS_37141 or subsequent
Solaris
PSOV_03489 or subsequent
The HP advisory is available at:
https://www12.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01428449
|
Cause:
Boundary error
|
Underlying OS:
Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 18 Apr 2008 08:22:13 -0400
Subject: HPSBMA02328 SSRT071293 rev.2 - HP OpenView Network Node Manager (OV NNM) Running Apache, Remote Cross Site Scripting (XSS), Denial of Service (DoS
|
https://www12.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01428449
CVE-2005-3352, CVE-2005-3357, CVE-2006-3747
|
|
