PT-2005-1513 · Lighttpd · Lighttpd

Published 2005-02-16 · Updated 2008-09-05 · CVE-2005-0453

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lighttpd versions 1.3.7 and earlier

Description The issue arises from the buffer urldecode function not properly handling control characters. This allows remote attackers to obtain the source code for CGI and FastCGI scripts by including a %00 (null) character after the file extension in a URL.

Recommendations For Lighttpd versions 1.3.7 and earlier, update to a version that fixes the buffer urldecode function issue to prevent remote attackers from obtaining source code for scripts.

Fix

Related Identifiers

CVE-2005-0453

Affected Products

Lighttpd

References · 5

• http://article.gmane.org/gmane.comp.web.lighttpd/1171 · Vendor Advisory
• http://secunia.com/advisories/14297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0453 · Security Note
• http://security.gentoo.org/glsa/glsa-200502-21.xml · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0453 · Note