{"id":"CVE-2011-1176","aliases":["DEBIAN-CVE-2011-1176","DSA-2202-1","EUVD-2011-1186","GHSA-8jf9-2rj5-99gg","openSUSE-SU-2024:10268-1"],"status":"published","title":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2...","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02721,"percentile":0.86123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2011-03-23T00:00:00Z","modified":"2026-10-23T17:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.2.17-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.2.17-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.2.17-2"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"apache2","fixed_in":["2.2.16-6+squeeze1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-6+squeeze1"}]}],"versions":["2.2.16-6","2.2.16-6+squeeze1~bpo50+1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-4.1"}]}],"bundled":48}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mpm-itk_project","product":"mpm-itk"}],"references":[{"url":"http://www.securityfocus.com/bid/46953","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:057","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66248","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0824","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0748","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2011/dsa-2202","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0749","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2011/03/21/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://openwall.com/lists/oss-security/2011/03/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1176"},{"url":"https://github.com/advisories/GHSA-8jf9-2rj5-99gg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-1176","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4979","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2011-1176","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","status":"published","published":"2011-03-29T18:00:00Z","modified":"2024-08-06T22:21:32.223Z","updated_at":"2026-11-02T14:35:38.321377Z"}],"euvd":[{"id":"EUVD-2011-1186","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","status":"published","published":"2011-03-29T18:00:00Z","modified":"2024-08-06T22:21:32Z","updated_at":"2026-11-03T01:55:57.729923Z"}],"ghsa":[{"id":"GHSA-8jf9-2rj5-99gg","title":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2...","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","status":"published","published":"2022-05-13T01:13:27Z","modified":"2023-02-01T05:04:17Z","updated_at":"2026-11-02T14:50:08.411477Z"}],"nvd":[{"id":"CVE-2011-1176","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","status":"published","published":"2011-03-29T18:55:02.003Z","modified":"2026-06-16T23:28:52.71Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:07.221228Z"}],"osv":[{"id":"CVE-2011-1176","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","status":"published","published":"2011-03-29T18:55:02Z","modified":"2026-04-10T03:41:42.023377Z","updated_at":"2026-11-02T15:43:57.991581Z"},{"id":"DEBIAN-CVE-2011-1176","description":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","status":"published","published":"2011-03-29T18:55:02.003Z","modified":"2026-10-23T17:47:32.563577381Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"DSA-2202-1","title":"apache2 - failure to drop root privileges","status":"published","published":"2011-03-23T00:00:00Z","modified":"2026-03-09T01:22:55.17907Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"openSUSE-SU-2024:10268-1","title":"apache2-2.4.23-4.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:25:01.364403Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}