Permissions, Privileges, and Access Controls in mod_wsgi - CVE-2014-0240
Published: May 27, 2014 / Updated: August 9, 2022
Vulnerability identifier: #VU41605
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0240
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.
Affected software
mod_wsgi
python26-mod_wsgi
Amazon Linux AMI
Gentoo Linux
Fedora
python26-mod_wsgi
Amazon Linux AMI
Gentoo Linux
Fedora
How to mitigate CVE-2014-0240
Install update from vendor's website.
mod_wsgi - update to 3.5
mod_wsgi - update to 3.5-1.el5
python26-mod_wsgi - update to 3.5-1.el5
mod_wsgi - update to 3.5-1.el5
python26-mod_wsgi - update to 3.5-1.el5