CVE-2011-1176
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.7%
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
Affected products
n/a · n/aReferences
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857http://lists.err.no/pipermail/mpm-itk/2011-March/000393.htmlhttp://lists.err.no/pipermail/mpm-itk/2011-March/000394.htmlhttp://openwall.com/lists/oss-security/2011/03/20/1http://openwall.com/lists/oss-security/2011/03/21/13https://exchange.xforce.ibmcloud.com/vulnerabilities/66248http://www.debian.org/security/2011/dsa-2202http://www.mandriva.com/security/advisories?name=MDVSA-2011:057http://www.securityfocus.com/bid/46953http://www.vupen.com/english/advisories/2011/0748http://www.vupen.com/english/advisories/2011/0749http://www.vupen.com/english/advisories/2011/0824