I don't understand what you are saying here. Apache forks to child processes. So 'owning' Apache only means you 'own' an Apache child process, which sounds a lot like 'owning' a mod_fastcgi process.

If Apache has been set up by someone who isn't a complete retard it will be suiding to an unprivilidged user the moment it gets a connection request. On most systems this user will be the 'nobody' or 'www-data' user.

Probably the best you could do with one of those accounts is read the source code to the CGI scripts, and if your scripts are programmed correctly then you are safe.

In short, mod_perl is secure, just like mod_ anything is. The memory leaks are another story.

____________________
Jeremy
I didn't believe in evil until I dated it.