CVE-2007-1741

Múltiples condiciones de carrera en suexec en Apache HTTP Server (httpd) versión 2.2.3, entre la comprobación de directorios y archivos, y su uso, permiten a usuarios locales alcanzar privilegios y ejecutar código arbitrario mediante el cambio del nombre de los directorios o realizando ataques de tipo symlink. NOTA: el investigador, que es confiable, afirma que el proveedor cuestiona el problema porque "the attacks described rely on an insecure server configuration" en la que el usuario "has write access to the document root”.

Local exploitation of multiple vulnerabilities within Apache Software Foundation's suexec utility could allow an attacker to execute arbitrary code as another user. iDefense has confirmed the existence of these vulnerabilities in the suexec binary distributed with the version 2.2.3 of the Apache httpd in Red Hat Inc.'s Fedora Core 4. This distribution is not vulnerable in the default configuration, as exploitation requires additional, but common, configuration changes to be made to the system. It is suspected that all previous versions of suexec are vulnerable, including the 1.3.x versions.