Fedora Core 5 : httpd-2.2.2-1.2 (2006-863)

High Nessus Plugin ID 24162


The remote Fedora Core host is missing a security update.


This update fixes a security issue in the mod_rewrite module.

Mark Dowd of McAfee Avert Labs reported an off-by-one security problem in the LDAP scheme handling of the mod_rewrite module. Where RewriteEngine was enabled, and for certain RewriteRules, this could lead to a pointer being written out of bounds. (CVE-2006-3747)

The ability to exploit this issue is dependent on the stack layout for a particular compiled version of mod_rewrite. The Fedora project has analyzed Fedora Core 4 and 5 binaries and determined that these distributions are vulnerable to this issue. However this flaw does not affect a default installation of Fedora Core; users who do not use, or have not enabled, the Rewrite module are not affected by this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected packages.

See Also


Plugin Details

Severity: High

ID: 24162

File Name: fedora_2006-863.nasl

Version: $Revision: 1.14 $

Type: local

Agent: unix

Published: 2007/01/17

Modified: 2015/10/21

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:httpd, p-cpe:/a:fedoraproject:fedora:httpd-debuginfo, p-cpe:/a:fedoraproject:fedora:httpd-devel, p-cpe:/a:fedoraproject:fedora:httpd-manual, p-cpe:/a:fedoraproject:fedora:mod_ssl, cpe:/o:fedoraproject:fedora_core:5

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2006/07/28

Reference Information

FEDORA: 2006-863