PT-2006-1861 · Lighttpd · Lighttpd

Tan Chew Keong · Published 2006-03-06 · Updated 2018-10-18 · CVE-2006-0814

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lighttpd versions 1.4.10 and prior

Description The issue allows remote attackers to read arbitrary source code via specially-crafted requests. This is caused by a validation error of the filename extension supplied by the user in the URL, which can be exploited to retrieve the source code of script files, such as PHP files, from the server. The vulnerability is triggered by requests containing trailing dot and space characters, which are ignored by Windows.

Recommendations For Lighttpd versions 1.4.10 and prior, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the vulnerable version of Lighttpd on Windows systems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-0814

Affected Products

Lighttpd

References · 13

• http://secunia.com/advisories/18886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0814 · Security Note
• http://secunia.com/secunia_research/2006-9/advisory · Vendor Advisory
• http://osvdb.org/23542 · Note
• http://securitylab.ru/vulnerability/263425.php · Note
• http://securityreason.com/securityalert/523 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0814 · Note
• http://securityfocus.com/bid/16893 · Note
• http://securityfocus.com/archive/1/426446/100/0/threaded · Note
• http://trac.lighttpd.net/trac/changeset/1005 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24976 · Note
• http://securitytracker.com/id?1015703 · Note
• http://vupen.com/english/advisories/2006/0782 · Note