CVE-2011-1176
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
| Software | From | Fixed in |
|---|---|---|
| mpm-itk_project / mpm-itk | 2.2.11-01 | 2.2.11-01.x |
| mpm-itk_project / mpm-itk | 2.2.11-02 | 2.2.11-02.x |
| debian / debian_linux | 5.0 | 5.0.x |
| debian / debian_linux | 7.0 | 7.0.x |
| debian / debian_linux | 6.0 | 6.0.x |
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857
- http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html
- http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html
- http://openwall.com/lists/oss-security/2011/03/20/1
- http://openwall.com/lists/oss-security/2011/03/21/13
- http://www.debian.org/security/2011/dsa-2202
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057
- http://www.securityfocus.com/bid/46953
- http://www.vupen.com/english/advisories/2011/0748
- http://www.vupen.com/english/advisories/2011/0749
- http://www.vupen.com/english/advisories/2011/0824
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime