NVD

Id
8145  
Name
CVE-2011-1176  
Description
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-03-29  
Modified Date
2011-09-06  
Seq
2011-1176  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
46787 8145 CVE-2011-1176 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857  View
46788 8145 CVE-2011-1176 [mpm-itk] 20110321 CVE 2011-1176: Sometimes runs as root instead of the default Apache user  View
46789 8145 CVE-2011-1176 [mpm-itk] 20110321 mpm-itk version 2.2.17-01 released  View
46790 8145 CVE-2011-1176 [oss-security] 20110320 CVE request: MPM-ITK module for Apache HTTPD  View
46791 8145 CVE-2011-1176 [oss-security] 20110321 Re: CVE request: MPM-ITK module for Apache HTTPD  View
46792 8145 CVE-2011-1176 DSA-2202  View
46793 8145 CVE-2011-1176 MDVSA-2011:057  View
46794 8145 CVE-2011-1176 46953  View
46795 8145 CVE-2011-1176 ADV-2011-0748  View
46796 8145 CVE-2011-1176 ADV-2011-0749  View
46797 8145 CVE-2011-1176 ADV-2011-0824  View
46798 8145 CVE-2011-1176 apache-mtmitk-weak-security(66248)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31358 JVNDB-2011-001598 Steinar H. Gunderson mpm-itk Multi-Processing Module における権限を取得される脆弱性 Steinar H. Gunderson mpm-itk Multi-Processing Module の itk.c 内にある configuration merger は、NiceValue が設定されており、AssignUserID が指定されていない状態のセクション設定を適切に処理しないため、権限を取得される可能性があります。 CVE-2011-1176 49083 CVE-2011-1176 8145 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001598.html 2011-03-29 2011-05-19 View