The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.

The remote host is affected by the vulnerability described in GLSA-201412-21 (mod_wsgi: Privilege escalation)

    Two vulnerabilities have been found in mod_wsgi:
      Error codes returned by setuid are not properly handled         (CVE-2014-0240)       A memory leak exists via the &ldquo;Content-Type&rdquo; header         (CVE-2014-0242)   Impact :

    A local attacker may be able to gain escalated privileges. Furthermore,       a remote attacker may be able to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

mod_wsgi allows you to host Python applications on the Apache HTTP Server. It was found that a remote attacker could leak portions of a mod_wsgi application's memory via the Content-Type header.

An updated mod_wsgi package that fixes one security issue is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The mod_wsgi adapter is an Apache module that provides a WSGI-compliant interface for hosting Python-based web applications within Apache.

It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. (CVE-2014-0240)

Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

Red Hat would like to thank Graham Dumpleton for reporting this issue.
Upstream acknowledges Robert Kisteleki as the original reporter.

All mod_wsgi users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

From Red Hat Security Advisory 2014:1091 :

An updated mod_wsgi package that fixes one security issue is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The mod_wsgi adapter is an Apache module that provides a WSGI-compliant interface for hosting Python-based web applications within Apache.

It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. (CVE-2014-0240)

Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

Red Hat would like to thank Graham Dumpleton for reporting this issue.
Upstream acknowledges Robert Kisteleki as the original reporter.

All mod_wsgi users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

According to the web server banner, the version of mod_wsgi running on the remote host is prior to version 3.5. It is, therefore, affected by a privilege escalation vulnerability.

The issue occurs due to the improper handling of error codes returned by 'setuid'. This flaw allows local attackers to manipulate the number of processes that are run by the user to affect the outcome of 'setuid' during the forking of daemon mode processes. This could allow the attacker to gain elevated privileges.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been discovered and corrected in apache-mod_wsgi :

It was found that mod_wsgi did not properly drop privileges if the call to setuid\(\) failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system (CVE-2014-0240).

It was discovered that mod_wsgi could leak memory of a hosted web application via the Content-Type header. A remote attacker could possibly use this flaw to disclose limited portions of the web application's memory (CVE-2014-0242).

The updated packages have been patched to correct these issues.

It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. (CVE-2014-0240)

Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

It was discovered that mod_wsgi could leak memory of a hosted web application via the 'Content-Type' header. A remote attacker could possibly use this flaw to disclose limited portions of the web application's memory. (CVE-2014-0242)

An updated mod_wsgi package that fixes two security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The mod_wsgi adapter is an Apache module that provides a WSGI-compliant interface for hosting Python-based web applications within Apache.

It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. (CVE-2014-0240)

Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

It was discovered that mod_wsgi could leak memory of a hosted web application via the 'Content-Type' header. A remote attacker could possibly use this flaw to disclose limited portions of the web application's memory. (CVE-2014-0242)

Red Hat would like to thank Graham Dumpleton for reporting these issues. Upstream acknowledges Robert Kisteleki as the original reporter of CVE-2014-0240, and Buck Golemon as the original reporter of CVE-2014-0242.

All mod_wsgi users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

From Red Hat Security Advisory 2014:0788 :

An updated mod_wsgi package that fixes two security issues is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The mod_wsgi adapter is an Apache module that provides a WSGI-compliant interface for hosting Python-based web applications within Apache.

It was found that mod_wsgi did not properly drop privileges if the call to setuid() failed. If mod_wsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. (CVE-2014-0240)

Note: mod_wsgi is not intended to provide privilege separation for WSGI applications. Systems relying on mod_wsgi to limit or sandbox the privileges of mod_wsgi applications should migrate to a different solution with proper privilege separation.

It was discovered that mod_wsgi could leak memory of a hosted web application via the 'Content-Type' header. A remote attacker could possibly use this flaw to disclose limited portions of the web application's memory. (CVE-2014-0242)

Red Hat would like to thank Graham Dumpleton for reporting these issues. Upstream acknowledges Robert Kisteleki as the original reporter of CVE-2014-0240, and Buck Golemon as the original reporter of CVE-2014-0242.

All mod_wsgi users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

http://modwsgi.readthedocs.org/en/develop/release-notes/version-3.5.ht ml

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

apache2-mod_wsgi was updated to fix two security issues.

These security issues were fixed :

  - Information exposure (CVE-2014-0242)

  - Local privilege escalation (CVE-2014-0240)

Two security issues have been found in the Python WSGI adapter module for Apache :

  - CVE-2014-0240     Robert Kisteleki discovered a potential privilege     escalation in daemon mode. This is not exploitable with     the kernel used in Debian 7.0/wheezy.

  - CVE-2014-0242     Buck Golemon discovered that incorrect memory handling     could lead to information disclosure when processing     Content-Type headers.

Robert Kisteleki discovered mod_wsgi incorrectly checked setuid return values. A malicious application could use this issue to cause a local privilege escalation when using daemon mode. (CVE-2014-0240)

Buck Golemon discovered that mod_wsgi used memory that had been freed.
A remote attacker could use this issue to read process memory via the Content-Type response header. This issue only affected Ubuntu 12.04 LTS. (CVE-2014-0242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79974	GLSA-201412-21 : mod_wsgi: Privilege escalation	Nessus	Gentoo Local Security Checks	high
78319	Amazon Linux AMI : mod_wsgi (ALAS-2014-376)	Nessus	Amazon Linux Local Security Checks	high
78318	Amazon Linux AMI : mod24_wsgi (ALAS-2014-375)	Nessus	Amazon Linux Local Security Checks	high
77386	RHEL 7 : mod_wsgi (RHSA-2014:1091)	Nessus	Red Hat Local Security Checks	medium
77385	Oracle Linux 7 : mod_wsgi (ELSA-2014-1091)	Nessus	Oracle Linux Local Security Checks	medium
77384	CentOS 7 : mod_wsgi (CESA-2014:1091)	Nessus	CentOS Local Security Checks	medium
76497	Apache mod_wsgi < 3.5 Apache Process Privilege Escalation	Nessus	Web Servers	high
76481	Mandriva Linux Security Advisory : apache-mod_wsgi (MDVSA-2014:137)	Nessus	Mandriva Local Security Checks	medium
76246	Scientific Linux Security Update : mod_wsgi on SL6.x i386/srpm/x86_64 (20140625)	Nessus	Scientific Linux Local Security Checks	high
76243	RHEL 6 : mod_wsgi (RHSA-2014:0788)	Nessus	Red Hat Local Security Checks	high
76231	Oracle Linux 6 : mod_wsgi (ELSA-2014-0788)	Nessus	Oracle Linux Local Security Checks	high
76217	CentOS 6 : mod_wsgi (CESA-2014:0788)	Nessus	CentOS Local Security Checks	high
76096	Fedora 20 : mod_wsgi-3.5-1.fc20 (2014-6944)	Nessus	Fedora Local Security Checks	medium
76095	Fedora 19 : mod_wsgi-3.5-1.fc19 (2014-6938)	Nessus	Fedora Local Security Checks	medium
76069	openSUSE Security Update : apache2-mod_wsgi (openSUSE-SU-2014:0782-1)	Nessus	SuSE Local Security Checks	high
74197	Debian DSA-2937-1 : mod-wsgi - security update	Nessus	Debian Local Security Checks	high
74185	Ubuntu 14.04 LTS : mod_wsgi vulnerabilities (USN-2222-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-0240

critical

Tenable Plugins

high

high

high

medium

medium

medium

high

medium

high

high

high

high

medium

medium

high

high

high