CVE-2006-7098

The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is…

published March 3, 2007

CVSS
—
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00578 · 46.9th percentile
Published
2007-03-03T19:00Z
EPSS history
Timeline
  • 03 MAR 19:00Z
    The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is…
    cvelistv5