Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 398761 (CVE-2012-0031) - <www-servers/apache-2.2.22 Scoreboard Invalid Free Security Bypass (CVE-2012-0031)
Summary: <www-servers/apache-2.2.22 Scoreboard Invalid Free Security Bypass (CVE-2012-...
Status: RESOLVED FIXED
Alias: CVE-2012-0031
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://secunia.com/advisories/47410/
Whiteboard: B4 [glsa]
Keywords:
Depends on: 401761
Blocks:
  Show dependency tree
 
Reported: 2012-01-13 12:21 UTC by Agostino Sarubbo
Modified: 2012-06-24 14:29 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2012-01-13 12:21:16 UTC 
From secunia security advisory at $URL:

Description:
The weakness is caused due to child processes being able to change the memory type record of the "scoreboard" shared memory segment, which can be exploited to cause an invalid free operation during the shutdown of the parent process.


Solution:
Fixed in the SVN repository.
http://svn.apache.org/viewvc?view=revision&revision=1230065
Comment 1 Sean Amoss (RETIRED) gentoo-dev Security 2012-04-18 00:03:35 UTC 
Added to existing GLSA request.
Comment 2 Tobias Heinlein (RETIRED) gentoo-dev 2012-06-21 20:27:45 UTC 
For the record: CVE in bug 401081.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2012-06-24 14:29:26 UTC 
This issue was resolved and addressed in
 GLSA 201206-25 at http://security.gentoo.org/glsa/glsa-201206-25.xml
by GLSA coordinator Tobias Heinlein (keytoaster).