Description
Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.8-5 | — |
| Debian 13 | apache2 | 2.2.8-5 | — |
| Debian 12 | apache2 | 2.2.8-5 | — |
References
- 38639 vdb-entry
- 20070411 Apache HTTPD suEXEC Multiple Vulnerabilities third-party-advisory
- [apache-http-dev] 20070328 Re: [Fwd: iDefense Final Notice [IDEF1445]] mailing-list
- apache-suexec-privilege-escalation(33584) vdb-entry
- 1017904 vdb-entry
- 23438 vdb-entry
- [apache-http-dev] 20070328 [Fwd: iDefense Final Notice [IDEF1445]] mailing-list