PT-2008-2707 · Lighttpd · Lighttpd

Johan Bergström · Publicado 2008-03-04 · Atualizado 2024-06-15 · CVE-2008-1111

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions lighttpd version 1.4.18

Description The issue allows remote attackers to obtain sensitive information by sending the source code of CGI scripts instead of a 500 error when a fork failure occurs in mod cgi.

Recommendations For lighttpd version 1.4.18, consider updating to a newer version that addresses this issue, as the current version may disclose sensitive information due to the handling of fork failures in mod cgi. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-1111

DSA-1513-1

OPENSUSE-SU-2024:10585-1

Produtos afetados

Lighttpd

Referências · 33

• https://osv.dev/vulnerability/CVE-2008-1111 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1111 · Aviso do Fabricante
• http://secunia.com/advisories/29318 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-1870 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10585-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-1869 · Nota
• https://suse.com/security/cve/CVE-2008-1531 · Nota
• https://suse.com/security/cve/CVE-2018-19052 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200803-10.xml · Aviso do Fabricante
• https://bugs.gentoo.org/show_bug.cgi?id=211956 · Nota
• https://suse.com/security/cve/CVE-2008-0983 · Nota
• http://secunia.com/advisories/29209 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1513 · Aviso do Fabricante
• http://trac.lighttpd.net/trac/changeset/2107 · Nota