CVE

Id
25100  
CVE No.
CVE-2007-1743  
Status
Candidate  
Description
suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.  
Phase
Assigned (20070328)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
249774 25100 CVE-2007-1743 IDEFENSE:20070411 Apache HTTPD suEXEC Multiple Vulnerabilities  View
249775 25100 CVE-2007-1743 URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511  View
249776 25100 CVE-2007-1743 MLIST:[apache-http-dev] 20070328 [Fwd: iDefense Final Notice [IDEF1445]]  View
249777 25100 CVE-2007-1743 URL:http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2  View
249778 25100 CVE-2007-1743 MLIST:[apache-http-dev] 20070328 Re: [Fwd: iDefense Final Notice [IDEF1445]]  View
249779 25100 CVE-2007-1743 URL:http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2  View
249780 25100 CVE-2007-1743 SECTRACK:1017904  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
58720 JVNDB-2006-000986 ClamAV の chm_decompress_stream() 関数におけるサービス運用妨害 (DoS) の脆弱性 ClamAV のlibclamav/chmunpack.c には、chm_decompress_stream() 関数において、CHM ファイルの取り扱いに不備があり、サービス運用妨害 (DoS) の脆弱性が存在します。 CVE-2007-1745 25100 7.1 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000986.html  View