A vulnerability in the Apache Portable Runtime (APR) library could compromise sensitive data in applications running on Unix platforms.
Identified as CVE-2023-49582, the vulnerability results from improper use of permissions on shared memory segments, which could allow unauthorized users to access sensitive information.
See also: Versa fixes zero-day vulnerability in Director GUI
Apache Portable Runtime (APR) is a set of libraries developed by the Apache Software Foundation that provide a consistent interface for system-level and network programming across different operating systems.
APR allows software developers to write code that can run on various platforms without the need to rewrite functionality for each specific platform.
“The lax permissions set by the Apache Portable Runtime library on Unix platforms allow users to access parts of shared memory, which can expose sensitive application data.”
The vulnerability discovered by security researcher Thomas Stangner does not affect non-Unix platforms or versions with APR_USE_SHMEM_SHMGET=1 (Apr. time). Users are advised to upgrade to APR version 1.7.5, which fixes this issue.
The vulnerability affects all Unix-based systems running APR versions 0.9.0 through 1.7.4. However, systems configured with APR_USE_SHMEM_SHMGET=1 in apr.h are not affected. Non-Unix platforms are also not affected by this issue.
Read more: GitHub: GHES vulnerability allows authentication bypass
Users and administrators are advised to upgrade to APR 1.7.5, which resolves this security flaw. This update ensures proper restricted access to shared memory permissions, thus preventing unauthorized access to data.
- CVE ID: CVE-2023-49582
- Severity: Moderate
- Affected software: Apache Portable Runtime (APR) versions 0.9.0 to 1.7.4
- Platform: Unix (non-Unix platforms not affected)
- Patch available: Upgrade to APR version 1.7.5
See also: SonicWall: Critical vulnerability in SonicOS
Stay informed and protect your systems by applying the necessary updates in a timely manner.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
