PT-2013-2247 · Sthttpd+1 · Thttpd

Published 2013-12-13 · Updated 2024-06-15 · CVE-2013-0348

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions sthttpd versions prior to 2.26.4-r2 thttpd version 2.25b

Description The issue allows local users to obtain sensitive information by reading the /var/log/thttpd.log file due to world-readable permissions.

Recommendations For sthttpd versions prior to 2.26.4-r2, update to version 2.26.4-r2 or later. For thttpd version 2.25b, consider restricting access to the /var/log/thttpd.log file until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-0348

OPENSUSE-SU-2024:10187-1

Affected Products

Thttpd

References · 12

• 🔥 http://opensource.dyc.edu/gitweb/?p=sthttpd.git;a=commitdiff;h=d2e186dbd58d274a0dea9b59357edc8498b5388d · Exploit
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00050.html · Vendor Advisory
• https://bugs.gentoo.org/show_bug.cgi?id=458896 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-0348 · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00015.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10187-1 · Vendor Advisory
• http://opensource.dyc.edu/gitweb/?p=sthttpd.git%3Ba=commitdiff%3Bh=d2e186dbd58d274a0dea9b59357edc8498b5388d · Note
• https://suse.com/security/cve/CVE-2013-0348 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0348 · Note
• https://suse.com/security/cve/CVE-2012-5640 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=924857 · Note
• http://openwall.com/lists/oss-security/2013/02/23/7 · Note