CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.6
CWE Name:  Permissions Privileges and Access Controls
Summary: the debian gnu/linux 033_-f_no_setsid patch for the apache http server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a cgi program that calls the tiocsti ioctl.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2007-03-03
Last Modified Date: 2017-07-29