Apache Vulnerability Exposed Unix Systems to Data Theft

A recently disclosed vulnerability in the Apache Portable Runtime (APR) library, identified as CVE-2023-49582, could expose sensitive application data on Unix platforms.

Apache Vulnerability

The flaw results from insufficient permissions on shared memory segments, potentially allowing unauthorized local users to access sensitive information.

The APR, developed by the Apache Software Foundation, provides a consistent interface for system-level and network programming across various operating systems.

APR enables developers to write cross-platform code without rewriting platform-specific functionality. Lax permissions in APR on Unix platforms could allow local users to access shared memory segments, exposing sensitive data.

Security researcher Thomas Stangner reported that this vulnerability affects Unix systems running APR versions 0.9.0 to 1.7.4, except those with APR_USE_SHMEM_SHMGET=1 in apr.h. Non-Unix platforms are unaffected. Users should upgrade to APR version 1.7.5 to resolve the issue.

Users and administrators are strongly advised to upgrade to APR version 1.7.5 to address and resolve this security flaw. The update fixes the issue by properly restricting shared memory permissions, ensuring that unauthorized users cannot access sensitive data. This upgrade is crucial for maintaining the security and integrity of systems affected by this vulnerability.

CVE Identifier: CVE-2023-49582
Severity: Moderate
Affected Software: Apache Portable Runtime (APR) versions 0.9.0 to 1.7.4
Platform: Unix (non-Unix platforms are unaffected)
Patch Available: Upgrade to APR version 1.7.5

Update your systems promptly to stay secure.