Detections
Analytics

Echo: apache2: security update to 2.4.68-1~deb13u1

high Tenable Cloud Security Plugin ID 458785

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the
 command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID
 owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes
 the issue because "the attacks described rely on an insecure server configuration" in which the user "has
 write access to the document root." In addition, because this is dependent on other vulnerabilities,
 perhaps this is resultant and should not be included in CVE. (CVE-2007-1743)

Solution

Update the apache2 library and its related packages to version 2.4.68-1~deb13u1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2007-1743

Plugin Details

Severity: High

ID: 458785

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.3

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2007-1743

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2026

Vulnerability Publication Date: 4/13/2007

Reference Information

CVE: CVE-2007-1743