Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | 2.0 (including) | 2.0 (including) |
| Http_server | Apache | 2.0.9 (including) | 2.0.9 (including) |
| Http_server | Apache | 2.0.28 (including) | 2.0.28 (including) |
| Http_server | Apache | 2.0.28-beta (including) | 2.0.28-beta (including) |
| Http_server | Apache | 2.0.32 (including) | 2.0.32 (including) |
| Http_server | Apache | 2.0.32-beta (including) | 2.0.32-beta (including) |
| Http_server | Apache | 2.0.34-beta (including) | 2.0.34-beta (including) |
| Http_server | Apache | 2.0.35 (including) | 2.0.35 (including) |
| Http_server | Apache | 2.0.36 (including) | 2.0.36 (including) |
| Http_server | Apache | 2.0.37 (including) | 2.0.37 (including) |
| Http_server | Apache | 2.0.38 (including) | 2.0.38 (including) |
| Http_server | Apache | 2.0.39 (including) | 2.0.39 (including) |
| Http_server | Apache | 2.0.40 (including) | 2.0.40 (including) |
| Http_server | Apache | 2.0.41 (including) | 2.0.41 (including) |
| Http_server | Apache | 2.0.42 (including) | 2.0.42 (including) |
| Http_server | Apache | 2.0.43 (including) | 2.0.43 (including) |
| Http_server | Apache | 2.0.44 (including) | 2.0.44 (including) |
| Http_server | Apache | 2.0.45 (including) | 2.0.45 (including) |
| Http_server | Apache | 2.0.46 (including) | 2.0.46 (including) |
| Http_server | Apache | 2.0.47 (including) | 2.0.47 (including) |
| Http_server | Apache | 2.0.48 (including) | 2.0.48 (including) |
| Http_server | Apache | 2.0.49 (including) | 2.0.49 (including) |
| Http_server | Apache | 2.0.50 (including) | 2.0.50 (including) |
| Http_server | Apache | 2.0.51 (including) | 2.0.51 (including) |
| Http_server | Apache | 2.0.52 (including) | 2.0.52 (including) |
| Http_server | Apache | 2.0.53 (including) | 2.0.53 (including) |
| Http_server | Apache | 2.0.54 (including) | 2.0.54 (including) |
| Http_server | Apache | 2.0.55 (including) | 2.0.55 (including) |
| Http_server | Apache | 2.0.56 (including) | 2.0.56 (including) |
| Http_server | Apache | 2.0.57 (including) | 2.0.57 (including) |
| Http_server | Apache | 2.0.58 (including) | 2.0.58 (including) |
| Http_server | Apache | 2.0.59 (including) | 2.0.59 (including) |
| Http_server | Apache | 2.0.60 (including) | 2.0.60 (including) |
| Http_server | Apache | 2.0.61 (including) | 2.0.61 (including) |
| Http_server | Apache | 2.0.63 (including) | 2.0.63 (including) |
| Http_server | Apache | 2.0.64 (including) | 2.0.64 (including) |
| Red Hat Enterprise Linux 5 | RedHat | httpd-0:2.2.3-63.el5_8.1 | * |
| Red Hat Enterprise Linux 6 | RedHat | httpd-0:2.2.15-15.el6_2.1 | * |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 | RedHat | httpd-0:2.2.17-15.4.ep5.el5 | * |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 | RedHat | httpd-0:2.2.17-15.4.ep5.el6 | * |
| Red Hat JBoss Web Server 1.0 | RedHat | * | |
| Apache2 | Ubuntu | hardy | * |
| Apache2 | Ubuntu | lucid | * |
| Apache2 | Ubuntu | maverick | * |
| Apache2 | Ubuntu | natty | * |
| Apache2 | Ubuntu | oneiric | * |
| Apache2 | Ubuntu | upstream | * |