CVE-2011-1176
CVE-2011-1176
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
EPSS 2,7% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
n/a
- Versions du logiciel
- n/a: Concernée
Aucun correctif publié
apache2 Debian:12
- Plages de versions concernées
- ECOSYSTEM: < 2.2.17-2
Mettez à jour vers 2.2.17-2
apache2 Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 2.2.17-2
Mettez à jour vers 2.2.17-2
apache2 Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 2.2.17-2
Mettez à jour vers 2.2.17-2
Sources originales
- http://www.securityfocus.com/bid/46953
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057
- http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248
- http://www.vupen.com/english/advisories/2011/0824
- http://www.vupen.com/english/advisories/2011/0748
- http://www.debian.org/security/2011/dsa-2202
- http://www.vupen.com/english/advisories/2011/0749
- http://openwall.com/lists/oss-security/2011/03/21/13
- http://openwall.com/lists/oss-security/2011/03/20/1
- http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html
- https://nvd.nist.gov/vuln/detail/CVE-2011-1176