VDB
CVE-2011-1176
CVE-2011-1176
PUBLISHED
CVSS 4.300000190734863 MEDIUM
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
EPSS 2.72% · 84.6th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
2.72%
84.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| debian | debian_linux | 5.0, 6.0, 7.0 |
| mpm-itk_project | mpm-itk | 2.2.11-01, 2.2.11-02 |
| n/a | n/a | * |
Timeline
- Mar 29, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- 46953 vdb
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857 url
- ADV-2011-0824 vdb
- ADV-2011-0748 vdb
- ADV-2011-0749 vdb
- [mpm-itk] 20110321 mpm-itk version 2.2.17-01 released mailing-list
- DSA-2202 vendor-advisory
- [mpm-itk] 20110321 CVE 2011-1176: Sometimes runs as root instead of the default Apache user mailing-list
- http://openwall.com/lists/oss-security/2011/03/20/1 mailing_list
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:057 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2011-1176 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66248 url
- http://openwall.com/lists/oss-security/2011/03/21/13 url