CVE-2011-1176

Published: Mar 29, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.

Affected (5)

Products: Mpm Itk Project: Mpm Itk · Debian: Debian Linux

Mpm Itk Project

1 product

1 product

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mpm Itk Project Mpm Itk	Version 2.2.11-01
Mpm Itk Project Mpm Itk	Version 2.2.11-02

Running on/with	Platform Versions
Apache Http Server	All versions

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0

References (24)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html

Source: secalert@redhat.com

Release NotesThird Party Advisory

http://openwall.com/lists/oss-security/2011/03/20/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://openwall.com/lists/oss-security/2011/03/21/13

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2011/dsa-2202

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:057

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/46953

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2011/0748

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0749

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0824

Source: secalert@redhat.com

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/66248

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

http://openwall.com/lists/oss-security/2011/03/20/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://openwall.com/lists/oss-security/2011/03/21/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.debian.org/security/2011/dsa-2202

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:057

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/46953

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2011/0748

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0749

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0824

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/66248

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.