CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1743
https://notcve.org/view.php?id=CVE-2007-1743
suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE. suexec en Apache HTTP Server (httpd) 2.2.3 no verifica las combinaciones de IDs de usuario y grupo sobre la linea de comandos, lo cual podría ser utilizado por un usuario local para acoplar otras vulnerabilidades en la creación de sus propios ficheros UID/GID de forma aleatoria si /proc está montado. NOTA: el investigador, que es creible, indica que el vendedor discutió este asunto porque "los ataques descritos dependen de la condiguración del servidor no segura" en el que el usuario "tiene permisos de escritura sobre el documento root". Además, dado que esto es dependiente deotras vulnerabilidades, quizás esto es el resultado y debería de incluirse en el CVE. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511 http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2 http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2 http://www.securitytracker.com/id?1017904 •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1741
https://notcve.org/view.php?id=CVE-2007-1741
Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." Múltiples condiciones de carrera en suexec en Apache HTTP Server (httpd) versión 2.2.3, entre la comprobación de directorios y archivos, y su uso, permiten a usuarios locales alcanzar privilegios y ejecutar código arbitrario mediante el cambio del nombre de los directorios o realizando ataques de tipo symlink. NOTA: el investigador, que es confiable, afirma que el proveedor cuestiona el problema porque "the attacks described rely on an insecure server configuration" en la que el usuario "has write access to the document root”. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511 http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2 http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2 http://osvdb.org/38639 http://www.securityfocus.com/bid/23438 http://www.securitytracker.com/id?1017904 https://exchange.xforce.ibmcloud.com/vulnerabilities/33584 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.8EPSS: 84%CPEs: 44EXPL: 0CVE-2006-4154
https://notcve.org/view.php?id=CVE-2006-4154
Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c. Vulnerabilidad de cadena de formato en el módulo mod_tcl 1.0 para Apache 2.x permite a atacantes locales o remotos (dependiendo del contexto) ejecutar código de su elección mediante especificadores de cadena de formato que no se manejan adecuadamente en una llamada a la función set_var en (1) tcl_cmds.c y (2) tcl_core.c. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=421 http://secunia.com/advisories/22458 http://secunia.com/advisories/22549 http://security.gentoo.org/glsa/glsa-200610-12.xml http://securitytracker.com/id?1017062 http://www.kb.cert.org/vuls/id/366020 http://www.osvdb.org/29536 http://www.securityfocus.com/bid/20527 http://www.vupen.com/english/advisories/2006/4033 https://exchange.xforce.ibmcloud.com/vulnerabilities/29550 •
CVSS: 4.3EPSS: 1%CPEs: 3EXPL: 3CVE-2006-4110 – Apache 2.2.2 - CGI Script Source Code Information Disclosure
https://notcve.org/view.php?id=CVE-2006-4110
Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems. Apache 2.2.2, cuando se ejecuta en Windows, permite a atacantes remotos leer código fuente de programas CGI mediante una petición que contenga caracteres en mayúscula (o mayúsculas alternadas) que evitan la directiva ScripAlias sensible a mayúsculas y minúsculas, pero permiten el acceso al archivo en sistemas de ficheros insensibles a mayúsculas y minúsculas. • https://www.exploit-db.com/exploits/28365 http://secunia.com/advisories/21490 http://securityreason.com/securityalert/1370 http://www.osvdb.org/27913 http://www.securityfocus.com/archive/1/442882/100/0/threaded http://www.securityfocus.com/archive/1/443487/100/200/threaded http://www.securityfocus.com/bid/19447 http://www.vupen.com/english/advisories/2006/3265 https://exchange.xforce.ibmcloud.com/vulnerabilities/28357 •
CVSS: 7.6EPSS: 97%CPEs: 7EXPL: 5CVE-2006-3747 – Apache < 1.3.37/2.0.59/2.2.3 mod_rewrite - Remote Overflow
https://notcve.org/view.php?id=CVE-2006-3747
Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules. Error de superación de límite (off-by-one) en el esquema ldap manejado en el modulo Rewrite (mod_rewrite) en Apache 1.3 desde 1.3.28, 2.0.46 y otras versiones anteriores 2.0.59, y 2.2, cuando RewriteEngine está activo, permite a atacantes remotos provocar denegación de servicio (Caida de aplicación) y posiblemente ejecutar código a rtavés de URLs manipuladas que no se manejan de forma adecuada utilizando ciertas reglas de reescritura. • https://www.exploit-db.com/exploits/2237 https://www.exploit-db.com/exploits/3996 https://www.exploit-db.com/exploits/16752 https://www.exploit-db.com/exploits/3680 https://github.com/defensahacker/CVE-2006-3747 http://docs.info.apple.com/article.html?artnum=307562 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449 http://kbase.redhat.com/faq/FAQ_68_8653.shtm http:/&#x • CWE-189: Numeric Errors •