PT-2014-3551 · Linux+5 · Linux+5

Publicado 2014-05-23 · Atualizado 2017-12-21 · CVE-2014-0240

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions mod wsgi versions prior to 3.5

Description The issue arises when the mod wsgi module for Apache is run in daemon mode on certain Linux kernels. It fails to properly handle error codes returned by setuid, allowing local users to gain privileges through vectors related to the number of running processes.

Recommendations For mod wsgi versions prior to 3.5, update to version 3.5 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-1386

CESA-2014_0788

CESA-2014_1091

CVE-2014-0240

DSA-2937-1

OPENSUSE-SU-2024:10457-1

RHSA-2014:0788

RHSA-2014:0789

RHSA-2014:1091

RHSA-2014_0788

RHSA-2014_1091

SUSE-RU-2015:0611-1

USN-2222-1

Produtos afetados

Alt Linux

Centos

Linux

Red Hat

Ubuntu

Mod Wsgi

Referências · 39

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0242 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-0240 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2014-0788.html · Nota
• https://osv.dev/vulnerability/USN-2222-1 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2014-1091.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8583 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-2222-1 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2014-0240 · Nota
• https://errata.altlinux.org/ALT-PU-2016-1386 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-0240 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2014-August/069981.html · Nota
• https://cve.org/CVERecord?id=CVE-2014-0240 · Nota de Segurança
• http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.5.html · Nota
• https://access.redhat.com/security/cve/CVE-2014-0240 · Nota
• https://lists.centos.org/pipermail/centos-announce/2014-August/032544.html · Nota