CVE-2012-0883: Medium severity Apache HTTP Server vulnerability
envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0883?
CVE-2012-0883 has a medium severity rating due to its potential to allow local users to exploit the vulnerability for privilege escalation.
How do I fix CVE-2012-0883?
To fix CVE-2012-0883, update to Apache HTTP Server version 2.4.2 or later, or ensure that the LD_LIBRARY_PATH does not contain zero-length directory entries.
Which versions of Apache HTTP Server are affected by CVE-2012-0883?
CVE-2012-0883 affects Apache HTTP Server versions prior to 2.4.2, as well as versions 2.2.0 through 2.2.23.
Can CVE-2012-0883 be exploited remotely?
No, CVE-2012-0883 can only be exploited locally by users who have access to execute the Apache HTTP Server.
What type of attack does CVE-2012-0883 facilitate?
CVE-2012-0883 facilitates attacks where local users can use a Trojan horse dynamic shared object (DSO) to gain elevated privileges.