CVE-2012-0031: Medium severity Apache HTTP Server vulnerability
Apache 2.2 fixed a possible crash on shutdown if a child changes the sbtype field in the scoreboard. Since unprivileged children should not be able to affect the parent in this way, this is treated as a Low severity security issue [1].
The reporter has a nice writeup of the flaw as well [2].
[1] http://svn.apache.org/viewvc?view=revision&revision=1230065 [2] http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/
Other sources
scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0031?
CVE-2012-0031 is classified as a Low severity security issue.
How do I fix CVE-2012-0031?
To fix CVE-2012-0031, upgrade Apache HTTP Server to version 2.2.22 or later.
Which software versions are affected by CVE-2012-0031?
CVE-2012-0031 affects Apache HTTP Server versions below 2.2.22, and various versions of Red Hat, Debian, and openSUSE distributions.
Is CVE-2012-0031 a remote code execution vulnerability?
No, CVE-2012-0031 is not a remote code execution vulnerability but rather a potential crash issue on shutdown.
Can unprivileged users exploit CVE-2012-0031?
No, unprivileged users should not be able to affect the parent process, which is a factor in the low severity classification of CVE-2012-0031.