Permissions, Privileges, and Access Controls in mod_wsgi - CVE-2014-0240

Vulnerability identifier: #VU41605

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-0240

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.

mod_wsgi
libapache2-mod-wsgi (Ubuntu package)
libapache2-mod-wsgi-py3 (Ubuntu package)
python26-mod_wsgi
Amazon Linux AMI
Gentoo Linux
Fedora
Ubuntu

Install update from vendor's website.

mod_wsgi - update to 3.5
libapache2-mod-wsgi (Ubuntu package) - addressed in versions 3.3-4ubuntu0.1, 3.4-4ubuntu2.1.13.10.1, 3.4-4ubuntu2.1.14.04.1
libapache2-mod-wsgi-py3 (Ubuntu package) - addressed in versions 3.3-4ubuntu0.1, 3.4-4ubuntu2.1.13.10.1, 3.4-4ubuntu2.1.14.04.1
mod_wsgi - update to 3.5-1.el5
python26-mod_wsgi - update to 3.5-1.el5

• http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
• http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.5.html
• http://rhn.redhat.com/errata/RHSA-2014-0789.html
• http://www.openwall.com/lists/oss-security/2014/05/21/1

• Security restrictions bypass in mod_wsgi
• Amazon Linux AMI update for mod_wsgi
• Amazon Linux AMI update for mod24_wsgi
• Gentoo update for mod_wsgi
• Fedora EPEL 5 update for mod_wsgi, python26-mod_wsgi
• Ubuntu update for mod-wsgi