Apache Mixed Platform AddType Directive Information Disclosure

CVE-2007-6514 describes a quirk where Apache HTTP Server on Linux, with its DocumentRoot mounted from a Windows SMB share via the old smbfs filesystem, would return raw .php (or other handler-bound) source instead of executing it when an attacker appended a trailing backslash to the URL. The Linux SMB client treated path/file.php\ as a valid lookup, while Apache's AddType handler matching did not. The end result: source disclosure, including any embedded DB credentials or secrets in the PHP file. Affected combinations were narrow — Linux 2.4-era kernels with smbfs and an Apache instance serving content directly from the SMB mount; modern cifs.ko and Samba behavior do not exhibit this.

Tenable scores this MEDIUM (CVSS v2 4.3 / v3 5.6) and that label is defensible only in 2007. In 2026, the prerequisite stack — Apache + smbfs (deprecated and removed from the kernel after 3.x) + DocumentRoot served from a Windows file share — is effectively extinct outside of a museum. The vendor severity is technically accurate for the pattern but operationally meaningless: virtually no enterprise on a current distro can reproduce this, and the fix (don't host your webroot on a Windows SMB share) was hygienic advice 19 years ago and is doctrine now.

Why this verdict

• Prerequisite extinction: smbfs was deprecated in 2007 and removed from the upstream kernel in the 3.x series. No currently supported RHEL, Ubuntu LTS, SLES, or Debian release can produce the affected configuration.
• Exposure population <<1%: the DocumentRoot-on-SMB pattern is anti-pattern in every Apache hardening guide since the Bush administration. Tenable's own scanner reports this primarily as a residual finding on long-frozen legacy hosts.
• Impact ceiling is confidentiality-only: no RCE, no integrity, no availability — and modern apps don't put live secrets in webroot-served files; they use vaults and env injection.
• Not KEV-listed, near-zero EPSS, no active exploitation telemetry in GreyNoise, Shodan, or Censys datasets through 2026.
• Role multiplier: even on a high-value role (e.g., an internal web app fronting an identity service), the chain still terminates at static source disclosure — no privilege elevation, no lateral movement primitive. The role floor does not promote past LOW because the impact primitive itself is bounded.

Why not higher?

MEDIUM would imply a live, reproducible exposure that justifies the effort of a remediation ticket across 10,000 hosts. The kernel-level driver required for the bug has been gone for 13 years; promoting this above IGNORE would create scan-noise debt on every legacy box for no defensive return.

Why not lower?

It is not literally impossible — a forgotten CentOS 5 jump box or an embedded appliance running a frozen 2.6 kernel could still match. IGNORE here means "document the accepted risk and stop spending cycles," not "the finding is technically false."

1. Confirm no DocumentRoot lives on an SMB mount — On any host the plugin flags, run mount | grep -E 'smbfs|cifs' and cross-check Apache's DocumentRoot directive against the mount table. If none overlap, the finding is non-exploitable — close as false positive. No mitigation SLA applies under the noisgate IGNORE bucket; treat as one-time hygiene.
2. Retire any host still running a kernel old enough to ship smbfs — Anything on Linux ≤ 2.6.x is end-of-life by a decade and has 100+ more serious CVEs than this one. Roll into your existing legacy-OS decommission program; no separate SLA needed.
3. Add a WAF normalization rule that strips or rejects backslashes in URL paths — Defense-in-depth that also kills off a family of path-traversal and handler-confusion bugs in any web stack you run. Implement at the edge in your normal change cadence.
4. Suppress plugin 17695 in Tenable with a documented exception — If recurring scans flag hosts that have been verified clean (no SMB-mounted webroot), create a scan policy exception with a one-line rationale citing this assessment, so the finding stops competing for analyst attention with real work.

Run on each Apache host flagged by Tenable plugin 17695, as a user with read access to /etc/httpd / /etc/apache2 and /proc/mounts (root is cleanest). Invoke: sudo ./check_17695.sh — exits 0 PATCHED (config not vulnerable), 1 VULNERABLE (DocumentRoot on smbfs/cifs), 2 UNKNOWN (config not parseable).

#!/usr/bin/env bash
# noisgate verifier — Tenable plugin 17695 / CVE-2007-6514
# Confirms whether Apache DocumentRoot resides on an SMB/CIFS mount on a host
# whose kernel still ships the vulnerable smbfs driver.
set -u

status="PATCHED"
reason=""

# 1) Locate Apache config roots
CONF_DIRS=("/etc/httpd" "/etc/apache2" "/usr/local/apache2/conf")
DOCROOTS=()
for d in "${CONF_DIRS[@]}"; do
  [ -d "$d" ] || continue
  while IFS= read -r line; do
    dr=$(echo "$line" | awk '{print $2}' | tr -d '"')
    [ -n "$dr" ] && DOCROOTS+=("$dr")
  done < <(grep -RhiE '^[[:space:]]*DocumentRoot' "$d" 2>/dev/null)
done

if [ "${#DOCROOTS[@]}" -eq 0 ]; then
  echo "UNKNOWN: no Apache DocumentRoot directive found"
  exit 2
fi

# 2) Check kernel for smbfs (extinct in Linux 3.x+)
KVER=$(uname -r)
SMBFS_PRESENT="no"
if modinfo smbfs >/dev/null 2>&1 || grep -qw smbfs /proc/filesystems 2>/dev/null; then
  SMBFS_PRESENT="yes"
fi

# 3) Compare each DocumentRoot to mount table
MOUNTS=$(awk '{print $2 " " $3}' /proc/mounts)
for dr in "${DOCROOTS[@]}"; do
  # walk up the path to find its mountpoint fstype
  path="$dr"
  while [ "$path" != "/" ] && [ -n "$path" ]; do
    fstype=$(echo "$MOUNTS" | awk -v p="$path" '$1==p {print $2}')
    if [ -n "$fstype" ]; then
      case "$fstype" in
        smbfs)
          status="VULNERABLE"
          reason="DocumentRoot $dr on smbfs mount $path"
          break 2
          ;;
        cifs)
          # cifs is not literally CVE-2007-6514, but is the same anti-pattern
          status="VULNERABLE"
          reason="DocumentRoot $dr on cifs mount $path (anti-pattern; verify backslash handling)"
          break 2
          ;;
      esac
      break
    fi
    path=$(dirname "$path")
  done
done

echo "$status: kernel=$KVER smbfs_loadable=$SMBFS_PRESENT ${reason:+— $reason}"
case "$status" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac

Sources

1. Tenable plugin 17695
2. NVD CVE-2007-6514
3. Red Hat solution 472693
4. Trend Micro Threat Encyclopedia entry
5. Vulners NASL record
6. CISA KEV catalog (for negative confirmation)
7. Linux kernel smbfs removal history
8. CWE-200