CVE - CVE-2011-1176

CVE-ID
CVE-2011-1176	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:46953 URL:http://www.securityfocus.com/bid/46953 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 DEBIAN:DSA-2202 URL:http://www.debian.org/security/2011/dsa-2202 MANDRIVA:MDVSA-2011:057 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2011:057~~ (Obsolete source) MLIST:[mpm-itk] 20110321 CVE 2011-1176: Sometimes runs as root instead of the default Apache user URL:http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html MLIST:[mpm-itk] 20110321 mpm-itk version 2.2.17-01 released URL:http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html MLIST:[oss-security] 20110320 CVE request: MPM-ITK module for Apache HTTPD URL:http://openwall.com/lists/oss-security/2011/03/20/1 MLIST:[oss-security] 20110321 Re: CVE request: MPM-ITK module for Apache HTTPD URL:http://openwall.com/lists/oss-security/2011/03/21/13 VUPEN:ADV-2011-0748 URL:~~http://www.vupen.com/english/advisories/2011/0748~~ (Obsolete source) VUPEN:ADV-2011-0749 URL:~~http://www.vupen.com/english/advisories/2011/0749~~ (Obsolete source) VUPEN:ADV-2011-0824 URL:~~http://www.vupen.com/english/advisories/2011/0824~~ (Obsolete source) XF:apache-mtmitk-weak-security(66248) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/66248
Assigning CNA
Red Hat, Inc.
Date Record Created
20110303	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20110303)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)