I was surfing apache details at
http://httpd.apache.org/docs/1.3/howto/cgi.htmland
http://httpd.apache.org/docs/1.3/mod/core.html#optionsdisabling apache user from executing files is not there.
however, you can circumvent the problem, like this:
a) permit execution only from a specific directory
b) forbid the user to do damage using selinux or pax
b) is not trivial but its the best thing to control what the www-data user can execute and what not.
