iDefense Security Advisory 04.11.07 – Local exploitation of multiple vulnerabilities within Apache Software Foundation’s suexec utility could allow an attacker to execute arbitrary code as another user. iDefense has confirmed the existence of these vulnerabilities in the suexec binary distributed with the version 2.2.3 of the Apache httpd in Red Hat Inc.’s Fedora Core 4. This distribution is not vulnerable in the default configuration, as exploitation requires additional, but common, configuration changes to be made to the system. It is suspected that all previous versions of suexec are vulnerable, including the 1.3.x versions.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/55885/04.11.07-1.txt
Source: https://packetstormsecurity.com/files/55885/iDEFENSE-Security-Advisory-2007-04-11.1.html