Moderate
CVE-2019-0211
CVE-2019-0211
Description
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Add Assessment
Technical Analysis
A vulnerability in Apache server versions 2.4.17–2.4.38 caused by an out-of-bounds array access can lead to an arbitrary function call. An attacker can trigger this to execute code in the context of the parent Apache process which often runs as root. In order for the exploit to trigger however, the Apache process must gracefully restart. This can be done on demand using apache2ctl graceful, but is also done automatically once at day by the logrotate utility (according to the original disclosure).
This exploit is a Local Privilege Escalation (LPE) vulnerability, so an attacker would already need to have some control on the system. This likely could be achieved through some kind of application vulnerability depending on what the Apache server is running.
CVSS V3 Severity and Metrics
General Information
Vendors
- apache,
- canonical,
- debian,
- fedoraproject,
- netapp,
- opensuse,
- oracle,
- redhat
Products
- communications session report manager 8.0.0,
- communications session report manager 8.1.0,
- communications session report manager 8.1.1,
- communications session report manager 8.2.0,
- communications session route manager 8.0.0,
- communications session route manager 8.1.0,
- communications session route manager 8.1.1,
- communications session route manager 8.2.0,
- debian linux 9.0,
- enterprise linux 8.0,
- enterprise linux eus 8.1,
- enterprise linux eus 8.2,
- enterprise linux eus 8.4,
- enterprise linux eus 8.6,
- enterprise linux eus 8.8,
- enterprise linux for arm 64 8.0 aarch64,
- enterprise linux for arm 64 eus 8.1 aarch64,
- enterprise linux for arm 64 eus 8.2 aarch64,
- enterprise linux for arm 64 eus 8.4 aarch64,
- enterprise linux for arm 64 eus 8.6 aarch64,
- enterprise linux for arm 64 eus 8.8 aarch64,
- enterprise linux for ibm z systems 8.0 s390x,
- enterprise linux for ibm z systems eus 8.1 s390x,
- enterprise linux for ibm z systems eus 8.2 s390x,
- enterprise linux for ibm z systems eus 8.4 s390x,
- enterprise linux for ibm z systems eus 8.6 s390x,
- enterprise linux for ibm z systems eus 8.8 s390x,
- enterprise linux for power little endian 8.0 ppc64le,
- enterprise linux for power little endian eus 8.1 ppc64le,
- enterprise linux for power little endian eus 8.2 ppc64le,
- enterprise linux for power little endian eus 8.4 ppc64le,
- enterprise linux for power little endian eus 8.6 ppc64le,
- enterprise linux for power little endian eus 8.8 ppc64le,
- enterprise linux server aus 8.2,
- enterprise linux server aus 8.4,
- enterprise linux server aus 8.6,
- enterprise linux server tus 8.2,
- enterprise linux server tus 8.4,
- enterprise linux server tus 8.6,
- enterprise linux server tus 8.8,
- enterprise linux update services for sap solutions 8.0,
- enterprise linux update services for sap solutions 8.1,
- enterprise linux update services for sap solutions 8.4,
- enterprise linux update services for sap solutions 8.6,
- enterprise linux update services for sap solutions 8.8,
- enterprise manager ops center 12.3.3,
- enterprise manager ops center 12.4.0,
- fedora 28,
- fedora 29,
- fedora 30,
- http server,
- http server 12.2.1.3.0,
- instantis enterprisetrack 17.1,
- instantis enterprisetrack 17.2,
- instantis enterprisetrack 17.3,
- jboss core services 1.0,
- leap 15.0,
- leap 42.3,
- oncommand unified manager -,
- openshift container platform 3.11,
- openshift container platform for power 3.11 ppc64le,
- retail xstore point of service 7.0,
- retail xstore point of service 7.1,
- software collections 1.0,
- ubuntu linux 14.04,
- ubuntu linux 16.04,
- ubuntu linux 18.04,
- ubuntu linux 18.10
References
Advisory
Miscellaneous
