Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883

Second, I need to know , what mean DSos mentioned on the Overview section. Is it necessary to have another vulnerability which allows an attacker to create an illicit dynamic library ?

And Finally, how can an attacker exploit this vulnerability ?

share|improve this question

1 Answer

up vote 3 down vote

Access vector of this vulnerability is Local, that means this vulnerability itself can not be exploited remotely. In other words, to exploit this vulnerability a hacker has to gain access to the system by exploiting a different vulnerability.

Exploitation allows local users to gain privileges by injecting a BackDoor/Trojan horse as a DSO (Dynamic Shared Object) in the current working directory during execution of apachectl process.

Hope that helps.

share|improve this answer
very useful Thank you – Mely Jun 11 '12 at 11:28
Always in the same context is there a vulnerability whose reference is mentioned at the CVE, that allows an attacker to access remotely and gain local acess to the Apache web server, in order to exploit CVE-2012-0883. – Mely Jun 11 '12 at 11:43
The other vulnerability could be anything, a vulnerability either on Apache or on any other network service that can be exploited from internet or local network. It could be any means of getting access to the system, then exploit this one. – Kapish M Jun 11 '12 at 11:49
my objective is to gain access to the Apache web server which allows me to exploit CVE-2012-0883. indeed,i have a server web in the DMZ zone of my system. my objective is that an attacker gain remotely access to the server web and then exploit CVE-2012-0883 but the problem is that when visiting cvedetails.com i can't find a vulnerability which allows me accessing the web server remotely. the first vulnerability that i will use must be mentioned in the NVD. – Mely Jun 11 '12 at 12:52
If you want to gain access to the web server then you must first find an vulnerability on the server that allows remote exploitation and code execution. Go through this list - cvedetails.com/vendor/45/Apache.html Out of many of the possible explications NVD cannot consider any one vulnerability to be prerequisite to this vulnerability. Rarely that happens. – Kapish M Jun 11 '12 at 13:19
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.