← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2007-1742

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2007-1742
1
 
PublicDate: 2007-04-13
2
 
Candidate: CVE-2007-1742
3
 
References: 
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1742
5
 
Description:
6
 
 suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for
7
 
 verifying whether the current directory is within the document root, which
8
 
 might allow local users to perform unauthorized operations on incorrect
9
 
 directories, as demonstrated using "html_backup" and "htmleditor" under an
10
 
 "html" directory.  NOTE: the researcher, who is reliable, claims that the
11
 
 vendor disputes the issue because "the attacks described rely on an
12
 
 insecure server configuration" in which the user "has write access to the
13
 
 document root."
14
 
Ubuntu-Description: 
15
 
Notes: 
16
 
 kees> negligible addition checks for suexec
17
 
Bugs: 
18
 
upstream_apache2: released (2.2.8-5)
19
 
dapper_apache2: ignored
20
 
edgy_apache2: ignored
21
 
feisty_apache2: ignored
22
 
devel_apache2: ignored