PT-2008-2707 · Lighttpd · Lighttpd

Johan Bergström · Published 2008-03-04 · Updated 2024-06-15 · CVE-2008-1111

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions lighttpd version 1.4.18

Description The issue allows remote attackers to obtain sensitive information by sending the source code of CGI scripts instead of a 500 error when a fork failure occurs in mod cgi.

Recommendations For lighttpd version 1.4.18, consider updating to a newer version that addresses this issue, as the current version may disclose sensitive information due to the handling of fork failures in mod cgi. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-1111

DSA-1513-1

OPENSUSE-SU-2024:10585-1

Affected Products

Lighttpd

References · 33

• https://osv.dev/vulnerability/CVE-2008-1111 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1111 · Vendor Advisory
• http://secunia.com/advisories/29318 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10585-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200803-10.xml · Vendor Advisory
• http://secunia.com/advisories/29209 · Vendor Advisory
• http://debian.org/security/2008/dsa-1513 · Vendor Advisory
• http://secunia.com/advisories/29235 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0763 · Vendor Advisory
• http://secunia.com/advisories/29275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1111 · Security Note
• http://secunia.com/advisories/29622 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00180.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1111 · Vendor Advisory