CVE-2007-1742: Low severity Apache HTTP Server vulnerability
suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "htmlbackup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-1742?
CVE-2007-1742 has a medium severity rating as it allows local users to manipulate files outside the intended document root.
How do I fix CVE-2007-1742?
To fix CVE-2007-1742, upgrade your Apache HTTP Server to version 2.2.4 or later, which addresses this vulnerability.
What type of vulnerability is CVE-2007-1742?
CVE-2007-1742 is a local file inclusion vulnerability affecting the suexec feature in Apache HTTP Server.
Who is affected by CVE-2007-1742?
Users of Apache HTTP Server version 2.2.3 are affected by CVE-2007-1742 if they utilize the suexec feature.
What might happen if CVE-2007-1742 is exploited?
If exploited, CVE-2007-1742 could allow unauthorized local users to perform actions on files in incorrect directories.