CVEvulnerability
CVE-2011-1176
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-03-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Description
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
Affected configurations
• mpm-itk project mpm-itk 2.2.11-01
• mpm-itk project mpm-itk 2.2.11-02
• debian debian linux 5.0
• debian debian linux 6.0
• debian debian linux 7.0
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 Issue Tracking, Patch, Third Party Advisory
- http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html Patch, Third Party Advisory
- http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html Release Notes, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/03/20/1 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/03/21/13 Mailing List, Third Party Advisory
- http://www.debian.org/security/2011/dsa-2202 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057 Third Party Advisory
- http://www.securityfocus.com/bid/46953 Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2011/0748 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0749 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0824 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248 Third Party Advisory, VDB Entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 Issue Tracking, Patch, Third Party Advisory
- http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html Patch, Third Party Advisory
- http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html Release Notes, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/03/20/1 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/03/21/13 Mailing List, Third Party Advisory
- http://www.debian.org/security/2011/dsa-2202 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057 Third Party Advisory
- http://www.securityfocus.com/bid/46953 Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2011/0748 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0749 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0824 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248 Third Party Advisory, VDB Entry