DescriptionThe configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs618857

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)wheezy2.2.22-13+deb7u6fixed
wheezy (security)2.2.22-13+deb7u8fixed
jessie (security), jessie2.4.10-10+deb8u8fixed
stretch, sid2.4.25-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2sourcelenny(not affected)
apache2-mpm-itksourcelenny(not affected)


[lenny] - apache2 <not-affected> (different source package in lenny: apache2-mpm-itk)
[lenny] - apache2-mpm-itk <not-affected> (bug was introduced later, in 2.2.11-01)

Search for package or bug name: Reporting problems