VDB
CVE-2011-1176
CVE-2011-1176
PUBLISHED
CVSS 4.300000190734863 MEDIUM
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
EPSS 0.71% · 72.6th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
0.71%
72.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| debian | debian_linux | 5.0, 6.0, 7.0 |
| mpm-itk_project | mpm-itk | 2.2.11-01, 2.2.11-02 |
| n/a | n/a | * |
Exploit Intelligence
- 46953 (circl)
- MDVSA-2011:057 (circl)
- [mpm-itk] 20110321 mpm-itk version 2.2.17-01 released (circl)
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 (circl)
- apache-mtmitk-weak-security(66248) (circl)
- ADV-2011-0824 (circl)
- ADV-2011-0748 (circl)
- DSA-2202 (circl)
- ADV-2011-0749 (circl)
- [oss-security] 20110321 Re: CVE request: MPM-ITK module for Apache HTTPD (circl)
…and 2 more exploits
Timeline
- Mar 29, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 2, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- 46953 vdb
- MDVSA-2011:057 vendor-advisory
- [mpm-itk] 20110321 mpm-itk version 2.2.17-01 released mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 url
- apache-mtmitk-weak-security(66248) vdb
- ADV-2011-0824 vdb
- ADV-2011-0748 vdb
- DSA-2202 vendor-advisory
- ADV-2011-0749 vdb
- [oss-security] 20110321 Re: CVE request: MPM-ITK module for Apache HTTPD mailing-list
- [oss-security] 20110320 CVE request: MPM-ITK module for Apache HTTPD mailing-list
- [mpm-itk] 20110321 CVE 2011-1176: Sometimes runs as root instead of the default Apache user mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2011-1176 advisory