Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Ubuntu 14.04 LTS: USN-2431-1 Moderate: mod_wsgi Local Privilege Escalation

ubuntu
Calendar Grey December 3, 2014
Dist Ubuntu Esm H88
Learn how to resolve the mod_wsgi security issue impacting various Ubuntu versions with comprehensive upgrade steps.
mod_wsgi could be made to run programs with incorrect privileges.

Summary

mod_wsgi could be made to run programs with incorrect privileges.

Software Description:

- mod-wsgi: Python WSGI adapter module for Apache

Details:

It was discovered that mod_wsgi incorrectly handled errors when setting up

the working directory and group access rights. A malicious application

could possibly use this issue to cause a local privilege escalation when

using daemon mode.

Topics%20covered

Topics Covered

security advisory local privilege escalation Ubuntu update instructions daemon mode mod_wsgi

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libapache2-mod-wsgi             3.5-1ubuntu0.1
  libapache2-mod-wsgi-py3         3.5-1ubuntu0.1

Ubuntu 14.04 LTS:
  libapache2-mod-wsgi             3.4-4ubuntu2.1.14.04.2
  libapache2-mod-wsgi-py3         3.4-4ubuntu2.1.14.04.2

Ubuntu 12.04 LTS:
  libapache2-mod-wsgi             3.3-4ubuntu0.2
  libapache2-mod-wsgi-py3         3.3-4ubuntu0.2

After a standard system update you need to restart your web service to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2431-1

CVE-2014-8583

Severity
important
Lowest
Low
Medium
High
Critical

December 03, 2014

Topics%20covered

Topics Covered

security advisory local privilege escalation Ubuntu update instructions daemon mode mod_wsgi

Package Information

https://launchpad.net/ubuntu/+source/mod-wsgi/3.5-1ubuntu0.1
https://launchpad.net/ubuntu/+source/mod-wsgi/3.4-4ubuntu2.1.14.04.2
https://launchpad.net/ubuntu/+source/mod-wsgi/3.3-4ubuntu0.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.