Wednesday, February 21, 2024

A Flaw in Apache HTTP Server Allows any Users to Gain Root Access

Apache HTTP server security update fixes multiple security vulnerabilities including the privilege escalation vulnerability that allows users to run PHP, CGI script to gain the root access.

Apache Privilege Escalation

The vulnerability affects all the releases between 2.4.17 to 2.4.38, and it can be tracked as CVE-2019-0211. A low privileged user could execute arbitrary code with the privileges of the root process by manipulating the scoreboard.

It affects Unix systems and the non-Unix systems are not affected, reads Apache security advisory.

mod_auth_digest access

The vulnerability affects Apache HTTP Server between 2.4 to 2.4.38, a race condition in mod_auth_digest allows any user with valid credentials can authenticate using another username. The vulnerability can be tracked as CVE-2019-0217.

mod_ssl access control bypass

A bug in mod_ssl allows a client with TLS 1.3 supporting Post-Handshake Authentication to bypass configured access control restrictions. The bug affects the releases 2.4.37 and 2.4.38 and the vulnerability can be tracked as CVE-2019-0215.

mod_http2, possible crash & read-after-free

The server’s with H2Upgrade enabled for h2 are affected, if they receive the request from http/1.1 to http/2, may lead to misconfiguration and crash. Sever that never enabled h2 protocol are unaffected.

“http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly”, the vulnerability can be tracked as CVE-2019-0197/CVE-2019-0196.

Httpd URL normalization

If the path URL contains multiple slashes such as LocationMatch and RewriteRule in regular expressions may cause the server to collapse.

The vulnerability affects the versions between 2.4.0 to 2.4.38 and it can be tracked as CVE-2019-0220.

Related Read

Debian Security Update – Fix for Vulnerabilities that Leads to DOS and Arbitrary Code Execution

Apple Released Security Updates for iOS, Safari, tvOS, iTunes & Fixed Several Vulnerabilities


Latest articles

Beware of VietCredCare Malware that Steals businesses’ Facebook Accounts

A new cybersecurity threat targeting Facebook advertisers in Vietnam, known as VietCredCare, has emerged....

Google Chrome 122 Update Addresses Critical Security Vulnerabilities

Google has recently unveiled Chrome 122, a significant milestone for the widely used web...

New Malicious PyPI Packages Use DLL Sideloading In A Supply Chain Attack

Researchers have discovered that threat actors have been using open-source platforms and codes for...

New Mingo Malware Attacking Linux Redis Servers To Mine Cryptocurrency

The malware, termed Migo by the creators, attempts to infiltrate Redis servers to mine cryptocurrency on...

Security Onion 2.4.50 Released for Defenders With New Features

Security Onion Solutions has recently rolled out the latest version of its network security...

VMware Urges to Remove Enhanced EAP Plugin to Stop Auth & Session Hijack Attacks

VMware has issued an urgent advisory to administrators to remove a deprecated authentication plugin...

LockBit Ransomware Members Charged by Authorities, Free Decryptor Released

In a significant blow to one of the most prolific ransomware operations, authorities from...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles