Privilege escalation in Apache HTTP Server - CVE-2019-0211

Vulnerability identifier: #VU18110

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-0211

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within MPM implementation due to the application does not properly maintain each child's listener bucket number in the scoreboard that may lead to unprivileged code or scripts run by server (e.g. via mod_php) to modify the scoreboard and abuse the privileged main process.

A local user can execute arbitrary code on the system with privileges of the Apache HTTP Server code process.

Apache HTTP Server
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Slackware Linux
Opensuse
Fedora
apache2 (Debian package)
apache2 (Alpine package)
apache2 (Ubuntu package)
httpd24 (Red Hat package)
httpd24-httpd (Red Hat package)
httpd
IBM API Connect
Dell Secure Connect Gateway
Oracle Communications Session Report Manager
Oracle HTTP Server
Oracle Retail Xstore Point of Service
Maximo Application Suite - IoT Component
Oracle Communications Session Route Manager
Oracle Enterprise Manager Ops Center
Instantis EnterpriseTrack

Install updates from vendor's website.

Apache HTTP Server - update to 2.4.39
apache2 (Debian package) - update to 2.4.25-3+deb9u7
apache2 (Alpine package) - update to 2.4.39-r0
apache2 (Ubuntu package) - addressed in versions 2.4.7-1ubuntu4.22, 2.4.18-2ubuntu3.10, 2.4.29-1ubuntu4.6, 2.4.34-1ubuntu2.1
IBM API Connect - update to 5.0.8.12
Dell Secure Connect Gateway - update to 5.12.00.10
httpd24 (Red Hat package) - update to mod_auth_mellon-0.13.1-2.el7.1
httpd24-httpd (Red Hat package) - addressed in versions 2.4.34-7.el6.1, 2.4.34-7.el7.1
httpd - addressed in versions 2.4.39-1.1.fc28, 2.4.39-2.fc29, 2.4.39-2.fc30
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6

• Exploit #6082 - Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation (June 17, 2021)
• Exploit #2292 - Exploits (Containing Self Made Perl Reproducers / PoC Codes) (April 7, 2020)
• Exploit #2018 - Apache-Exploit-2019 (CVE-2019-0211-apache & CVE-2019-6977-imagecolormatch) (March 18, 2020)

• http://www.apache.org/dist/httpd/CHANGES_2.4

• Multiple vulnerabilities in Apache HTTP Server
• Debian update for apache2
• Ubuntu update for Apache HTTP Server
• OpenSUSE Linux update for apache2
• OpenSUSE Linux update for apache2
• OpenSUSE Linux update for apache2
• Slackware Linux update for httpd
• Amazon Linux AMI update for httpd24
• Gentoo update for Apache
• Red Hat update for httpd:2.4
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Instantis EnterpriseTrack
• Privilege escalation in apache2 (Alpine package)
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Fedora 29 update for httpd
• Fedora 28 update for httpd
• Fedora 30 update for httpd
• Red Hat Software Collections update for httpd24-httpd and httpd24-mod_auth_mellon
• Multiple vulnerabilities in Oracle HTTP Server
• Multiple vulnerabilities in Oracle Enterprise Manager Ops Center
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service