PT-2006-1809 · Php+1 · Php+1

Publicado 2006-02-18 · Atualizado 2017-07-20 · CVE-2006-0760

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LightTPD versions 1.4.8 and earlier

Description The issue allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization on case-insensitive filesystems. This can be demonstrated by a request for a file with an extension like index.PHP when the configuration only invokes the PHP interpreter for .php names.

Recommendations For LightTPD versions 1.4.8 and earlier, consider updating the configuration to handle case-insensitive filesystems properly, or restrict access to sensitive files until a proper fix is applied. As a temporary workaround, consider disabling the invocation of the PHP interpreter for files with unexpected capitalization in their extensions.

Correção

Identificadores relacionados

CVE-2006-0760

Produtos afetados

Lighttpd

Php

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0760 · Nota
• http://lighttpd.net/news · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24699 · Nota
• http://secunia.com/advisories/18869 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0760 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0550 · Nota
• http://osvdb.org/23229 · Nota