CVEvulnerability
CVE-2013-1048
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-03-06
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
Affected configurations
• debian apache2 (<= 2.2.16-6)
• debian apache2 (<= 2.2.22-12)
Related
Weakness · not in database (1)
References
- http://security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz Patch
- http://www.debian.org/security/2013/dsa-2637 Vendor Advisory
- http://security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz Patch
- http://www.debian.org/security/2013/dsa-2637 Vendor Advisory