Vulnerability Description
envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.2.0, < 2.2.23 |
| Opensuse | Opensuse | 11.4 |
References
- http://article.gmane.org/gmane.comp.apache.devel/48158Broken Link
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlBroken LinkMailing List
- http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.htmlMailing ListThird Party Advisory
- http://marc.info/?l=bugtraq&m=134012830914727&w=2Issue TrackingMailing ListThird Party Advisory
- http://secunia.com/advisories/48849Not Applicable
- http://support.apple.com/kb/HT5880Broken LinkThird Party Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1296428PatchVendor Advisory
- http://www.apache.org/dist/httpd/Announcement2.4.htmlVendor Advisory
- http://www.apachelounge.com/Changelog-2.4.htmlRelease NotesThird Party Advisory
- http://www.securityfocus.com/bid/53046Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1026932Broken LinkThird Party AdvisoryVDB Entry
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cerThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74901Third Party AdvisoryVDB Entry
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c0Broken Link
FAQ
What is CVE-2012-0883?
CVE-2012-0883 is a vulnerability with a CVSS score of 6.9 (MEDIUM). envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the c...
How severe is CVE-2012-0883?
CVE-2012-0883 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-0883?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Opensuse Opensuse.