PT-2013-3133 · Lighttpd · Lighttpd

Stefan Bã¼Hler · Publicado 2013-03-21 · Atualizado 2017-08-29 · CVE-2013-1427

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions lighttpd versions prior to 1.4.28

Description The issue allows local users to hijack the PHP control socket and perform unauthorized actions, such as forcing the use of a different version of PHP via a symlink attack or a race condition, due to a configuration file for the FastCGI PHP support creating a socket file with a predictable name in /tmp.

Recommendations For versions prior to 1.4.28, update to version 1.4.28 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-1427

DSA-2649-1

Produtos afetados

Lighttpd

Referências · 12

• https://osv.dev/vulnerability/CVE-2013-1427 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-1427 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1427 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1427 · Aviso do Fabricante
• http://osvdb.org/91462 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1427 · Nota
• http://securityfocus.com/bid/58528 · Nota
• http://debian.org/security/2013/dsa-2649 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-1427 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-1427 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82897 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1427 · Aviso do Fabricante