VDB
CVE-2011-1176
CVE-2011-1176
PUBLISHED
CVSS 4.300000190734863 MEDIUM
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
EPSS 2.72% · 85.8th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
2.72%
85.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| debian | debian_linux | 5.0, 6.0, 7.0 |
| mpm-itk_project | mpm-itk | 2.2.11-01, 2.2.11-02 |
| n/a | n/a | * |
Timeline
- Mar 29, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
References
- 46953 vdb
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 url
- ADV-2011-0824 vdb
- ADV-2011-0748 vdb
- ADV-2011-0749 vdb
- [mpm-itk] 20110321 mpm-itk version 2.2.17-01 released mailing-list
- DSA-2202 vendor-advisory
- [mpm-itk] 20110321 CVE 2011-1176: Sometimes runs as root instead of the default Apache user mailing-list
- http://openwall.com/lists/oss-security/2011/03/20/1 mailing_list
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2011-1176 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248 url
- http://openwall.com/lists/oss-security/2011/03/21/13 url