AttackerKBAKB:3275A6E3-042F-4EE9-BC7B-92FFE4191B17CVE-2019-0211
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Recent assessments:
zeroSteiner at April 17, 2020 10:28pm UTC reported:
A vulnerability in Apache server versions 2.4.17β2.4.38 caused by an out-of-bounds array access can lead to an arbitrary function call. An attacker can trigger this to execute code in the context of the parent Apache process which often runs as root. In order for the exploit to trigger however, the Apache process must gracefully restart. This can be done on demand using apache2ctl graceful, but is also done automatically once at day by the logrotate utility (according to the original disclosure).
This exploit is a Local Privilege Escalation (LPE) vulnerability, so an attacker would already need to have some control on the system. This likely could be achieved through some kind of application vulnerability depending on what the Apache server is running.
Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 3
References
lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html
lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html
lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html
packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html
packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html
www.apache.org/dist/httpd/CHANGES_2.4.39
www.openwall.com/lists/oss-security/2019/04/02/3
www.openwall.com/lists/oss-security/2019/07/26/7
www.securityfocus.com/bid/107666
access.redhat.com/errata/RHBA-2019:0959
access.redhat.com/errata/RHSA-2019:0746
access.redhat.com/errata/RHSA-2019:0980
access.redhat.com/errata/RHSA-2019:1296
access.redhat.com/errata/RHSA-2019:1297
access.redhat.com/errata/RHSA-2019:1543
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0211
httpd.apache.org/security/vulnerabilities_24.html
lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e@%3Cdev.community.apache.org%3E
lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa@%3Cusers.httpd.apache.org%3E
lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28@%3Cdev.community.apache.org%3E
lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e@%3Cdev.community.apache.org%3E
lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E
lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
lists.fedoraproject.org/archives/list/[email protected]/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN
lists.fedoraproject.org/archives/list/[email protected]/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7
lists.fedoraproject.org/archives/list/[email protected]/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT
seclists.org/bugtraq/2019/Apr/16
seclists.org/bugtraq/2019/Apr/5
security.gentoo.org/glsa/201904-20
security.netapp.com/advisory/ntap-20190423-0001
support.f5.com/csp/article/K32957101
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us
usn.ubuntu.com/3937-1
www.debian.org/security/2019/dsa-4422
www.exploit-db.com/exploits/46676
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
www.synology.com/security/advisory/Synology_SA_19_14
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.974 High
EPSS
Percentile
99.9%