PT-2007-3106 · Apache · Apache Http Server

Publicado 2007-04-13 · Atualizado 2017-07-29 · CVE-2007-1741

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server (httpd) version 2.2.3

Description: The issue involves multiple race conditions in suexec, allowing local users to gain privileges and execute arbitrary code. This can be achieved by renaming directories or performing symlink attacks. It's noted that the attacks rely on an insecure server configuration where the user has write access to the document root.

Recommendations: For Apache HTTP Server (httpd) version 2.2.3, consider restricting write access to the document root to minimize the risk of exploitation. As a temporary workaround, review and secure server configurations to prevent users from having unnecessary write access, which could mitigate the risk associated with this issue.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2007-1741

Produtos afetados

Apache Http Server

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-1741 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2007-1741 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33584 · Nota
• http://securityfocus.com/bid/23438 · Nota
• http://osvdb.org/38639 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1741 · Aviso do Fabricante
• http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2007-1741 · Aviso do Fabricante
• http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2 · Nota
• http://securitytracker.com/id?1017904 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1741 · Nota