Back
CVE-2006-3747
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions…
- 7.6HighCVSS base score
- 97.1%Exploitation in 30 daysEPSS · top 0.1% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 5Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module and 4 Exploit-DB entries for it.
Show the exploits5
Metasploit modules1 module
- Apache Module mod_rewrite LDAP Protocol Buffer Overflow (Metasploit module) (opens in a new tab)
exploit/windows/http/apache_mod_rewrite_ldapRank greatdisclosed 28 Jul 2006
Exploit-DB4 entries
- Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit) (Exploit-DB entry) (opens in a new tab)
EDB-ID 16752remote, windowspublished 15 Feb 2010Verified
- Apache 2.0.58 mod_rewrite (Windows 2003) - Remote Overflow (Exploit-DB entry) (opens in a new tab)
EDB-ID 3996remote, windowspublished 26 May 2007Verified
- Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow (Exploit-DB entry) (opens in a new tab)
EDB-ID 3680remote, windows_x86published 7 Apr 2007Verified
- Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow (Exploit-DB entry) (opens in a new tab)
EDB-ID 2237remote, multiplepublished 21 Aug 2006Verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By redhat
- 8 days later
· 8 days later
Published
- 18 years later
· 18 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | High7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 97.1% · top 0.1% of all CVEs (11 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.
Affected products
n/a
- affected n/a
References
References90
- 21266 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 21307 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- HPSBMA02250 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
- ADV-2006-3995 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- apache-modrewrite-offbyone-bo(28063) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- 102662 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
- SSRT071293 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
- http://www-1.ibm.com/support/docview.wss?uid=swg27007951 (opens in a new tab)x_refsource_CONFIRMx_transferred
- SSRT061265 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
- ADV-2006-4300 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 23028 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://svn.apache.org/viewvc?view=rev&revision=426144 (opens in a new tab)x_refsource_MISCx_transferred
- ADV-2006-3282 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 21284 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- PK29156 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
- http://kbase.redhat.com/faq/FAQ_68_8653.shtm (opens in a new tab)x_refsource_MISCx_transferred
- 22523 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2008-1246 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- SSRT090208 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
- 23260 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2006-3264 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- SUSE-SA:2006:043 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- ADV-2008-0924 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 21313 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 29849 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2006-4015 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 21273 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- TA08-150A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
- 21478 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 20060728 Apache mod_rewrite Buffer Overflow Vulnerability (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- GLSA-200608-01 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
- 20060728 [Announcement] Apache HTTP Server 2.2.3 (2.0.59, 1.3.37) Released (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 22368 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 26329 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- HPSBUX02145 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 102663 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
- 29420 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://www.apache.org/dist/httpd/Announcement2.0.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- 19204 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 21245 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2006-4868 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- APPLE-SA-2008-03-18 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- 30430 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2006-4207 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- APPLE-SA-2008-05-28 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- MDKSA-2006:133 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
- 21315 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- VU#395412 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
- 21509 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 21346 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 1016601 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- http://docs.info.apple.com/article.html?artnum=307562 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 20060728 rPSA-2006-0139-1 httpd mod_ssl (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- DSA-1131 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- 21247 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2006-3884 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- ADV-2008-1697 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 20060820 POC & exploit for Apache mod_rewrite off-by-one (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- https://issues.rpath.com/browse/RPL-538 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 22262 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- OpenPKG-SA-2006.015 (opens in a new tab)vendor-advisoryx_refsource_OPENPKGx_transferred
- 1312 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
- DSA-1132 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- PK29154 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
- 21241 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- ADV-2006-3017 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- ADV-2007-2783 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
- 20060728 Apache 1.3.29/2.X mod_rewrite Buffer Overflow Vulnerability CVE-2006-3747 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- USN-328-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- PK27875 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
- 27588 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
- 2006-0044 (opens in a new tab)vendor-advisoryx_refsource_TRUSTIXx_transferred
- 22388 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 21197 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2006-3741 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2006-3747)Record last updated .