PT-2007-3108 · Apache+1 · Apache Http Server+1

Published 2007-04-13 · Updated 2023-02-13 · CVE-2007-1743

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server (httpd) version 2.2.3

Description: The issue in suexec allows local users to potentially create arbitrary UID/GID owned files if /proc is mounted, by leveraging other vulnerabilities. This is dependent on an insecure server configuration where the user has write access to the document root.

Recommendations: For Apache HTTP Server (httpd) version 2.2.3, consider restricting write access to the document root to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1743

Affected Products

Apache Http Server

Debian

References · 12

• https://security-tracker.debian.org/tracker/source-package/apache2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1743 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1743 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-1743 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1743 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-1743 · Vendor Advisory
• http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2 · Note
• http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1743 · Note
• http://securitytracker.com/id?1017904 · Note
• https://packages.debian.org/src:apache2 · Note