NVD

Id
65641  
Name
CVE-2006-7098  
Description
The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.  
Reject
 
CVSS Version
2  
CVSS Score
6.6  
Severity
Medium  
CVSS Base Score
6.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
2.7  
CVSS Vector
(AV:L/AC:M/Au:S/C:C/I:C/A:C)  
Pub Date
2016-12-20  
Published
2007-03-03  
Modified Date
2008-11-15  
Seq
2006-7098  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
341949 65641 CVE-2006-7098 20070226 Local user to root escalation in apache 1.3.34 (Debian only)  View
341950 65641 CVE-2006-7098 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357561  View
341951 65641 CVE-2006-7098 22732  View
341952 65641 CVE-2006-7098 debian-apache-tty-privilege-escalation(32708)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
59597 JVNDB-2006-001863 Apache HTTP Server における tty 端末への権限を取得される脆弱性 Apache HTTP Server の Debian GNU/Linux 033_-F_NO_SETSID パッチは、httpd が対話形式で起動されている際、tty 端末制御から httpd を適切に関連付けを解除しないため、tty 端末への権限を取得される脆弱性が存在します。 CVE-2006-7098 23200 CVE-2006-7098 65641 6.6 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-001863.html 2006-03-18 2012-06-26 View