PT-2006-1809 · Php+1 · Php+1

Published 2006-02-18 · Updated 2017-07-20 · CVE-2006-0760

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LightTPD versions 1.4.8 and earlier

Description The issue allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization on case-insensitive filesystems. This can be demonstrated by a request for a file with an extension like index.PHP when the configuration only invokes the PHP interpreter for .php names.

Recommendations For LightTPD versions 1.4.8 and earlier, consider updating the configuration to handle case-insensitive filesystems properly, or restrict access to sensitive files until a proper fix is applied. As a temporary workaround, consider disabling the invocation of the PHP interpreter for files with unexpected capitalization in their extensions.

Fix

Related Identifiers

CVE-2006-0760

Affected Products

Lighttpd

Php

References · 7

• http://secunia.com/advisories/18869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0760 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0760 · Note
• http://lighttpd.net/news · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24699 · Note
• http://vupen.com/english/advisories/2006/0550 · Note
• http://osvdb.org/23229 · Note