PT-2014-2140 · Apache+2 · Apache Http Server+2

Ansgar Burchardt · Published 2014-03-20 · Updated 2014-03-27 · CVE-2011-3196

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Domain Technologie Control (DTC) versions prior to 0.34.1

Description The setup script in DTC uses world-readable permissions for the /etc/apache2/apache2.conf file, allowing local users to obtain the dtcdaemons MySQL password by reading the file.

Recommendations For versions prior to 0.34.1, update to version 0.34.1 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/apache2/apache2.conf file to restrict access until a patch is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-3196

DSA-2365-1

Affected Products

Apache Http Server

Domain Technologie Control

Mysql Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-3196 · Security Note
• http://debian.org/security/2011/dsa-2365 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/08/24/10 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637485 · Note
• http://openwall.com/lists/oss-security/2011/08/13/1 · Note
• http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=blob%3Bf=debian/changelog%3Bhb=3eb6ef5cea6c571aae5e49e1930de778eca280c3 · Note