CVEvulnerability

CVE-2007-1741

6.2 MEDIUM Published 2007-04-13 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-04-13
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.2 MEDIUM — AV:L/AC:H/Au:N/C:C/I:C/A:C
Weaknesses
CWE-362

Description

Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."

Affected configurations

• apache http server 2.2.3

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References