Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
BID:8822
Info
Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
| Bugtraq ID: | 8822 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 14 2003 12:00AM |
| Updated: | Oct 14 2003 12:00AM |
| Credit: | This vulnerability was discovered by Zen-Parse. |
| Vulnerable: |
snert.com mod_throttle 3.0 |
| Not Vulnerable: | |
Discussion
Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
The mod_throttle Apache module is said to be prone to a vulnerability that could allow for local privilege elevation. The problem occurs due to the mod_throttle module incorrectly storing critical data within shared memory that is accessible by a user with 'apache' privileges. As a result, an attacker may be capable of corrupting memory pointers and a data file located in a shared memory segment. This could ultimately lead to privilege elevation on the local system.
The mod_throttle Apache module is said to be prone to a vulnerability that could allow for local privilege elevation. The problem occurs due to the mod_throttle module incorrectly storing critical data within shared memory that is accessible by a user with 'apache' privileges. As a result, an attacker may be capable of corrupting memory pointers and a data file located in a shared memory segment. This could ultimately lead to privilege elevation on the local system.
Exploit / POC
Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
Solution:
The vendor is said to have been contacted, and it has been reported that this issue is meant to be addressed in the next release of mod_throttle, however this information has not been confirmed by Symantec.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The vendor is said to have been contacted, and it has been reported that this issue is meant to be addressed in the next release of mod_throttle, however this information has not been confirmed by Symantec.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.