« Volver al listado

CVE-2013-1048

Estado: ModificadaMedia (4.6)—

El script Debian apache2ctl en el paquete apache2 de scqueeze anterior a v2.2.16-6+squeeze11, wheezy anterior a v2.2.22-13 y sid anterior a v2.2.22-13 para el Servidor Apache HTTP en Debian GNU/Linux no crea correctamente el directorio lock /var/lock/apache2, permitiendo a usuarios locales obtener privilegios a través de un ataque de enlace simbólico no especificado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Debian — Apache2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1048",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-06T13:10:25.900",
  "references": [
    {
      "url": "http://security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2637",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2637",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack."
    },
    {
      "lang": "es",
      "value": "El script Debian apache2ctl en el paquete apache2 de scqueeze anterior a v2.2.16-6+squeeze11, wheezy anterior a v2.2.22-13 y sid anterior a v2.2.22-13 para el Servidor Apache HTTP en Debian GNU/Linux no crea correctamente el directorio lock /var/lock/apache2, permitiendo a usuarios locales obtener privilegios a través de un ataque de enlace simbólico no especificado."
    }
  ],
  "lastModified": "2026-06-16T23:50:46.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:debian:apache2:*:squeeze10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33FEECC6-DBCD-437A-80C0-72E52F3D0FB6",
              "versionEndIncluding": "2.2.16-6"
            },
            {
              "criteria": "cpe:2.3:a:debian:apache2:*:sid:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4EBC7F2-5C6B-4B5F-941A-B02E4E9C09EB",
              "versionEndIncluding": "2.2.22-12"
            },
            {
              "criteria": "cpe:2.3:a:debian:apache2:*:wheezy:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13C8684B-D7D0-4BE9-8DC4-2B69E34746A4",
              "versionEndIncluding": "2.2.22-12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}