lighttpd mod_cgi and mod_userdir Information Disclosure Security Issues - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0)

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

lighttpd mod_cgi and mod_userdir Information Disclosure Security Issues

Secunia Advisory:	SA29235
Release Date:	2008-03-05
Last Update:	2008-03-11

Critical:	Less critical
Impact:	Exposure of system information Exposure of sensitive information
Where:	From remote
Solution Status:	Vendor Patch

Software:	lighttpd 1.x

CVE reference:	CVE-2008-1111 (Secunia mirror) CVE-2008-1270 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Some security issues have been reported in lighttpd, which can be exploited by malicious people to disclose potentially sensitive information. 1) A security issue is caused due to an error in mod_cgi, which can lead to the disclosure of source code when lighttpd is unable to fork. 2) A security issue is caused due to the mod_userdir module using "$HOME" by default if no userdir.path is set. This can be exploited to disclose the content of arbitrary files on certain systems via e.g. the "nobody" user. The security issues are reported in version 1.4.18. Solution: Update to version 1.4.19. Provided and/or discovered by: 1) Reported in a Gentoo bug. 2) Reported in a bug by Julien Cayzac Changelog: 2008-03-11: Added vulnerability #2 and updated "Solution" and "Original Advisory" section. Original Advisory: 1) http://www.lighttpd.net/security/lighttpd_sa_2008_02.txt http://trac.lighttpd.net/trac/changeset/2107 https://bugs.gentoo.org/show_bug.cgi?id=211956 2) http://www.lighttpd.net/security/lighttpd_sa_2008_03.txt http://trac.lighttpd.net/trac/ticket/1587 http://trac.lighttpd.net/trac/changeset/2125



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

8 Related Secunia Security Advisories

1. lighttpd OpenSSL Error Queue Denial of Service Vulnerability

2. lighttpd File Descriptor Array Denial of Service Vulnerability

3. lighttpd mod_fastcgi PHP Header Overflow

4. lighttpd Multiple Vulnerabilities

5. lighttpd "mtime" and "\r\n\r\n\" Denial of Service Vulnerabilities

6. Lighttpd Script Source Disclosure Vulnerability

7. Lighttpd Case-Insensitive Filename Source Code Disclosure

8. lighttpd "%00" Application Source Code Disclosure Vulnerability

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Red Hat update for vsftpd

2.	Red Hat update for rdesktop

3.	Red Hat update for rdesktop

4.	Red Hat update for nss_ldap

5.	Red Hat update for coreutils

6.	Red Hat update for kernel

7.	OpenBSD BIND Query Port DNS Cache Poisoning

8.	Red Hat update for mysql

9.	Debian update for clamav

10.	Drupal Session Fixation Vulnerability