CVE-2011-1176

Description

The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.

Related CPE's

ampm-itk_projectmpm-itk2.2.11-01*******

ampm-itk_projectmpm-itk2.2.11-02*******

aapachehttp_server********

odebiandebian_linux5.0*******

odebiandebian_linux7.0*******

odebiandebian_linux6.0*******

References

[oss-security] 20110320 CVE request: MPM-ITK module for Apache HTTPD

Mailing ListThird Party Advisory

46953

Third Party AdvisoryVDB Entry

[oss-security] 20110321 Re: CVE request: MPM-ITK module for Apache HTTPD

Mailing ListThird Party Advisory

ADV-2011-0749

Third Party Advisory

[mpm-itk] 20110321 CVE 2011-1176: Sometimes runs as root instead of the default Apache user

PatchThird Party Advisory

DSA-2202

Third Party Advisory

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857

Issue TrackingPatchThird Party Advisory

[mpm-itk] 20110321 mpm-itk version 2.2.17-01 released

Release NotesThird Party Advisory

ADV-2011-0748

Third Party Advisory

MDVSA-2011:057

Third Party Advisory

ADV-2011-0824

Third Party Advisory

apache-mtmitk-weak-security(66248)

Third Party AdvisoryVDB Entry

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:M/Au:N/C:N/I:P/A:N

AccessVector

NETWORK

AccessComplexity

MEDIUM

Authentication

NONE

ConfidentialityImpact

NONE

IntegrityImpact

PARTIAL

AvailabilityImpact

NONE

BaseScore

4.300000190734863

Created by Yello
About Severity.io