CVE-2013-1048

2013-03-0600:00:00

ubuntu.com

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

The Debian apache2ctl script in the apache2 package squeeze before
2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for
the Apache HTTP Server on Debian GNU/Linux does not properly create the
/var/lock/apache2 lock directory, which allows local users to gain
privileges via an unspecified symlink attack.

Notes

Author	Note
seth-arnold	not part of apache upstream; vulnerability shared with Debian

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchapache2< 2.2.8-1ubuntu0.25UNKNOWN
ubuntu10.04noarchapache2< 2.2.14-5ubuntu8.11UNKNOWN
ubuntu11.10noarchapache2< 2.2.20-1ubuntu1.4UNKNOWN
ubuntu12.04noarchapache2< 2.2.22-1ubuntu1.3UNKNOWN
ubuntu12.10noarchapache2< 2.2.22-6ubuntu2.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	apache2	< 2.2.8-1ubuntu0.25	UNKNOWN
ubuntu	10.04	noarch	apache2	< 2.2.14-5ubuntu8.11	UNKNOWN
ubuntu	11.10	noarch	apache2	< 2.2.20-1ubuntu1.4	UNKNOWN
ubuntu	12.04	noarch	apache2	< 2.2.22-1ubuntu1.3	UNKNOWN
ubuntu	12.10	noarch	apache2	< 2.2.22-6ubuntu2.2	UNKNOWN