Overview
Cherokee fails to drop root privileges after binding to port 80.
Description
Cherokee is a compact, open-source web server. Cherokee is designed to start as root and drop root privileges after binding to port 80. However, versions of Cherokee prior to 0.2.7 fail to drop root privileges properly. By exploting the vulnerability described in CERT VU#711315 in these versions of Cherokee, attackers may execute arbitrary commands as root. |
Impact
Remote attackers may run arbitrary commands as root. |
Solution
Upgrade Upgrade to Cherokee 0.2.7: |
Vendor Information
245795
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to GOBBLES Security Advisory for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | None |
| Severity Metric: | 8.12 |
| Date Public: | 2001-12-29 |
| Date First Published: | 2002-09-24 |
| Date Last Updated: | 2002-09-24 15:53 UTC |
| Document Revision: | 8 |