CVE-2011-1176: Medium severity debian linux vulnerability
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1176?
CVE-2011-1176 has a moderate severity rating as it allows remote attackers to gain privileges under specific conditions.
How do I fix CVE-2011-1176?
To fix CVE-2011-1176, ensure that the AssignUserID directive is properly configured alongside NiceValue in your Apache HTTP Server configuration.
What versions are affected by CVE-2011-1176?
CVE-2011-1176 affects mpm-itk versions 2.2.11-01 and 2.2.11-02, as well as certain versions of Debian Linux 5.0, 6.0, and 7.0.
Can CVE-2011-1176 lead to potential exploit scenarios?
Yes, if misconfigured, CVE-2011-1176 can allow unauthorized privilege escalation, making it a potential exploit risk.
Is CVE-2011-1176 specific to a particular server software?
CVE-2011-1176 specifically impacts the mpm-itk Multi-Processing Module used with the Apache HTTP Server.