The configuration merger in itk.c in the Steinar H. Gunderson...
Vulnerability Description
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-1176
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/46953
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057
- http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248
- http://www.vupen.com/english/advisories/2011/0824
- http://www.vupen.com/english/advisories/2011/0748
- http://www.debian.org/security/2011/dsa-2202
- http://www.vupen.com/english/advisories/2011/0749
- http://openwall.com/lists/oss-security/2011/03/21/13
- http://openwall.com/lists/oss-security/2011/03/20/1
- http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html
Affected Vendor
mpm-itk project
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.