Description
suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
References (5)
Core 5
Core References
Third Party Advisory third-party-advisory
x_refsource_idefense
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/38640
Mailing List mailing-list
x_refsource_mlist
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1017904
Mailing List mailing-list
x_refsource_mlist
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
Scores
EPSS
0.0069
EPSS Percentile
48.6%
Details
Status
published
Products (1)
apache/http_server
2.2.3
Published
Apr 13, 2007
Tracked Since
Feb 18, 2026