727
VMScore

CVE-2019-0211

Published: 08/04/2019 Updated: 07/11/2023
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 727
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

fedoraproject fedora 29

fedoraproject fedora 30

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 18.04

canonical ubuntu linux 18.10

debian debian linux 9.0

opensuse leap 42.3

opensuse leap 15.0

Vendor Advisories

Several security issues were fixed in the Apache HTTP Server ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 SP2 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Pack Apache Server 2429 Service Pack 2 zip release for RHEL 6 and RHEL 7 is availableRed Hat Product Security has rated this release a ...
Synopsis Important: httpd:24 security update Type/Severity Security Advisory: Important Topic An update for the httpd:24 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CV ...
Synopsis Important: httpd24-httpd and httpd24-mod_auth_mellon security update Type/Severity Security Advisory: Important Topic An update for httpd24-httpd and httpd24-mod_auth_mellon is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 SP2 security update Type/Severity Security Advisory: Important Topic An update is now available for JBoss Core Services on RHEL 6 and RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A Co ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 SP2 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Pack Apache Server 2429 Service Pack 2 packages for Microsoft Windows and Oracle Solaris are now availableRed Hat Product Security has ...
Debian Bug report logs - #920302 apache2: CVE-2018-17189: mod_http2, DoS via slow, unneeded request bodies Package: src:apache2; Maintainer for src:apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 23 Jan 2019 20:33:05 UTC Severity: ...
Debian Bug report logs - #920303 apache2: CVE-2018-17199: mod_session_cookie does not respect expiry time Package: src:apache2; Maintainer for src:apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 23 Jan 2019 20:36:02 UTC Severity: ...
Several vulnerabilities have been found in the Apache HTTP server CVE-2018-17189 Gal Goldshtein of F5 Networks discovered a denial of service vulnerability in mod_http2 By sending malformed requests, the http/2 stream for that request unnecessarily occupied a server thread cleaning up incoming data, resulting in denial of service ...
In Apache HTTP Server with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard (CVE-2019-0211) A vulnerability was found in ...
In Apache HTTP Server with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard (CVE-2019-0211) mod_http2: read-after-free on ...
Severity Unknown Remote Unknown Type Unknown Description AVG-946 apache 2438-1 2439-1 Medium Testing ...

Exploits

<?php # CARPE (DIEM): CVE-2019-0211 Apache Root Privilege Escalation # Charles Fol # @cfreal_ # 2019-04-08 # # INFOS # # cfrealgithubio/carpe-diem-cve-2019-0211-apache-local-roothtml # # USAGE # # 1 Upload exploit to Apache HTTP server # 2 Send request to page # 3 Await 6:25AM for logrotate to restart Apache # 4 python35 is now s ...
Apache versions 2417 up to 2438 apache2ctl graceful logrotate local privilege escalation exploit ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts <!--X-Subject-Header-End--> <!--X-Head-of-Message ...

Github Repositories

Exploits using shell scripts having a vulnerable endpoint This repository contains examples on how to create a very basic vulnerable endpoint using Apache and PHP Provided, are also a set of sample shell scripts to run exploits with a fake cryptocurrency binary mining software Contents cryptominer Fake code and binary of a "cryptominer" The binary is also pushed to

HttpdReverseShell HttpdReverseShell is a Python script that allows you to obtain a reverse shell This runs a httpd server on a attackers machine which will give a shell access when the clinet connects to the server via a script I coded this from a attacker perspective so just the HTTP protocol is highly likely to be opened on the outbound or egress firewall rules, since it�

Wgel-CTF

#Linux #Wget NMAP Scan nmap -sV -sC -p- 1010207235 To see the versions of the services running (-sV) To perform a script scan using the default set of scripts (-sC) To scan all ports from 1 through 65535 (-p-) OPEN PORTS 22/tcp ssh 80/tcp http Interesting info: A person named Jessie is mentioned in the website source code: Let&#

Capstone Project: The Importance of Company Digital Security Description Project consists of performing reconnaissance, identifying targets and running scans, identifying vulnerabilities, threat assessment, and technical reports Perform Reconnaissance Introduction: The task at hand requires building a robust profile on the target, Artemis This profile will include the target&

Crosswalk Nessus findings with the CISA Known and Exploited Vulnerabilities (KEV) catalog.

Nessus Crosswalk for CISA Known Exploited Vulnerabilities (KEV) nessus_crosswalk is a capability that returns vulnerability results from Nessus scans that map to the most recent CISA KEV catalog The output is a sorted list of CVE IDs, based on number of occurrences in the Nessus scans, in the following format: {"CVE-####-#####": Number_of_Occurrences} Install $ git

HTML5 Background Video Want to play a video in the background of a container or body itself ? This plugin will help you do exactly that I'd suggest you to read this article too Demo Features Resizing The video element in use will automatically adapt to the container's dimensions It will also resize as the browser window resizes Overlay Plugin doesn't supports

An in-depth explanation of how I would conduct a risk assessment from the perspective of a Cyber security analyst.

Risk-Assessment-Cap-Stone- An in-depth explanation of how I would conduct a risk assessment from the perspective of a Cyber security analyst CapStone Project (Artemis Gas Incorporated) Micah Razelle Fleming Cyber Security Career Track 7/17/2023 Overview: Me and my cyber security team of penetration testers will be responsible for gathering reliable information for our client,

Recent Articles

A patchy Apache a-patchin: HTTP server gets fix for worrying root access hole
The Register • Shaun Nichols in San Francisco • 03 Apr 2019

Rogue 'worker' processes can sneak in with elevated privileges at startup LibreOffice patches malicious code-execution bug, Apache OpenOffice – wait for it, wait for it – doesn't

Apache HTTP Server has been given a patch to address a potentially serious elevation of privilege vulnerability. Designated CVE-2019-0211, the flaw allows a "worker" process to change its privileges when the host server resets itself, potentially allowing anyone with a local account to run commands with root clearance, essentially giving them complete control over the targeted machine. The bug was discovered by researcher Charles Fol of security shop Ambionics, who privately reported the issue t...

References

CWE-416https://www.exploit-db.com/exploits/46676/https://www.debian.org/security/2019/dsa-4422https://usn.ubuntu.com/3937-1/https://seclists.org/bugtraq/2019/Apr/5https://seclists.org/bugtraq/2019/Apr/16https://httpd.apache.org/security/vulnerabilities_24.htmlhttp://www.securityfocus.com/bid/107666http://www.openwall.com/lists/oss-security/2019/04/02/3http://www.apache.org/dist/httpd/CHANGES_2.4.39http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.htmlhttp://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.htmlhttps://access.redhat.com/errata/RHSA-2019:0746http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.htmlhttps://support.f5.com/csp/article/K32957101http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.htmlhttps://security.gentoo.org/glsa/201904-20https://security.netapp.com/advisory/ntap-20190423-0001/http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.htmlhttps://access.redhat.com/errata/RHSA-2019:0980https://access.redhat.com/errata/RHBA-2019:0959https://www.synology.com/security/advisory/Synology_SA_19_14https://access.redhat.com/errata/RHSA-2019:1297https://access.redhat.com/errata/RHSA-2019:1296https://access.redhat.com/errata/RHSA-2019:1543https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttp://www.openwall.com/lists/oss-security/2019/07/26/7https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_ushttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.httpd.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e%40%3Cdev.community.apache.org%3Ehttps://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28%40%3Cdev.community.apache.org%3Ehttps://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e%40%3Cdev.community.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://usn.ubuntu.com/3937-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/46676