PT-2007-3107 · Apache · Apache Http Server

Published 2007-04-13 · Updated 2023-02-13 · CVE-2007-1742

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server (httpd) version 2.2.3

Description: The issue in suexec allows local users to potentially perform unauthorized operations on incorrect directories due to a partial comparison for verifying the current directory within the document root. This could be exploited in scenarios such as having "html backup" and "htmleditor" under an "html" directory. It's noted that the vendor disputes this issue, stating that the described attacks rely on an insecure server configuration where the user has write access to the document root.

Recommendations: For Apache HTTP Server (httpd) version 2.2.3, consider reconfiguring server settings to prevent users from having write access to the document root as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1742

Affected Products

Apache Http Server

References · 10

• https://osv.dev/vulnerability/CVE-2007-1742 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1742 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1742 · Security Note
• http://osvdb.org/38640 · Note
• http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1742 · Note
• http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511 · Note
• http://securitytracker.com/id?1017904 · Note