VULNERABILITY INTELLIGENCE

CVE-2006-7098

CVSS score6.6 MEDIUM
EPSS probability0.58%
CISA KEVNot currently listed
Published2007-03-03
Last modified2026-06-16
CVSS vectorAV:L/AC:M/Au:S/C:C/I:C/A:C

Description

The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.

Primary references