PT-2008-5610 · Lighttpd · Lighttpd

Anders · Publicado 2008-10-03 · Atualizado 2018-11-29 · CVE-2008-4360

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: lighttpd versions prior to 1.4.20

Description: The issue allows remote attackers to bypass intended access restrictions due to case-sensitive comparisons on filename components in configuration options when a case-insensitive operating system or filesystem is used. This can be demonstrated by a request for a .PHP file when there is a configuration rule for .php files.

Recommendations: For versions prior to 1.4.20, update to version 1.4.20 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-4360

DSA-1645-1

Produtos afetados

Lighttpd

Referências · 29

• http://secunia.com/advisories/32834 · Nota
• http://xforce.iss.net/xforce/xfdb/45689 · Nota
• http://trac.lighttpd.net/trac/ticket/1589 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1645 · Aviso do Fabricante
• http://secunia.com/advisories/32480 · Nota
• http://lighttpd.net/security/lighttpd-1.4.x_userdir_lowercase.patch · Aviso do Fabricante
• http://secunia.com/advisories/32972 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4360 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2741 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-4360 · Aviso do Fabricante
• http://trac.lighttpd.net/trac/changeset/2308 · Aviso do Fabricante
• http://securityfocus.com/bid/31600 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45689 · Nota
• http://openwall.com/lists/oss-security/2008/09/30/1 · Nota