suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the     command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID     owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes     the issue because the attacks described rely on an insecure server configuration in which the user has     write access to the document root. In addition, because this is dependent on other vulnerabilities,     perhaps this is resultant and should not be included in CVE. (CVE-2007-1743)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host appears to be running Apache and is potentially affected by the following vulnerabilities:

  - Multiple race conditions exist in suexec between the     validation and usage of directories and files. Under     certain conditions local users are able to escalate     privileges and execute arbitrary code through the     renaming of directories or symlink attacks.
    (CVE-2007-1741)

  - Apache's suexec module only performs partial     comparisons on paths, which could result in privilege     escalation. (CVE-2007-1742)

  - Apache's suexec module does not properly verify user     and group IDs on the command line. When the '/proc'     filesystem is mounted, a local user can utilize suexec     to escalate privileges. (CVE-2007-1743)

Note that this plugin only checks for the presence of Apache, and does not actually check the configuration.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.6. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability in mod_proxy. 
  - A cross-site scripting vulnerability in mod_status.
  - A local denial of service vulnerability associated with     the Prefork MPM module.
  - An information leak in mod_cache.
  - A denial of service vulnerability in mod_cache.

In addition, it offers a workaround for a cross-site scripting issue in mod_autoindex. 

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether any of the affected modules are in use on the remote server or to check for the issues themselves.

ID	Name	Product	Family	Type	Severity
254135	Linux Distros Unpatched Vulnerability : CVE-2007-1743	Nessus	Misc.	Local	critical
17693	Apache mod_suexec Multiple Privilege Escalation Vulnerabilities	Nessus	Web Servers	Remote	high
26023	Apache 2.2.x < 2.2.6 Multiple Vulnerabilities (DoS, XSS, Info Disc)	Nessus	Web Servers	Remote	medium

Detections

Analytics

CVE-2007-1743

high

Tenable Plugins

critical

high

medium