PT-2005-1513 · Lighttpd · Lighttpd

Publicado 2005-02-16 · Atualizado 2008-09-05 · CVE-2005-0453

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lighttpd versions 1.3.7 and earlier

Description The issue arises from the buffer urldecode function not properly handling control characters. This allows remote attackers to obtain the source code for CGI and FastCGI scripts by including a %00 (null) character after the file extension in a URL.

Recommendations For Lighttpd versions 1.3.7 and earlier, update to a version that fixes the buffer urldecode function issue to prevent remote attackers from obtaining source code for scripts.

Correção

Identificadores relacionados

CVE-2005-0453

Produtos afetados

Lighttpd

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0453 · Nota
• http://article.gmane.org/gmane.comp.web.lighttpd/1171 · Aviso do Fabricante
• http://secunia.com/advisories/14297 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0453 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200502-21.xml · Aviso do Fabricante