Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.

Fixes CVE-2010-1151 mod_auth_shadow: bad wait(2) call causes randomized authorization behaviour (#578168).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in apache-mod_auth_shadow :

A race condition was found in the way mod_auth_shadow used an external helper binary to validate user credentials (username / password pairs). A remote attacker could use this flaw to bypass intended access restrictions, resulting in ability to view and potentially alter resources, which should be otherwise protected by authentication (CVE-2010-1151).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
47433	Fedora 12 : mod_auth_shadow-2.2-8.fc12 (2010-6359)	Nessus	Fedora Local Security Checks	medium
47430	Fedora 11 : mod_auth_shadow-2.2-8.fc11 (2010-6323)	Nessus	Fedora Local Security Checks	medium
47427	Fedora 13 : mod_auth_shadow-2.2-8.fc13 (2010-6290)	Nessus	Fedora Local Security Checks	medium
45566	Mandriva Linux Security Advisory : apache-mod_auth_shadow (MDVSA-2010:081)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-1151

high

Tenable Plugins

medium

medium

medium

medium