lighttpd (1.4.11-3ubuntu3.8) dapper-security; urgency=low
* SECURITY UPDATE: (LP: #200987)
+ debian/patches/91_CVE-2008-1270.dpatch
- mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set,
uses a default of $HOME, which might allow remote attackers to read
arbitrary
files, as demonstrated by accessing the ~nobody directory.
* References
+ http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1270
+ http://trac.lighttpd.net/trac/ticket/1587
+ http://trac.lighttpd.net/trac/changeset/2120
-- Emanuele Gentili <[EMAIL PROTECTED]> Tue, 11 Mar 2008
15:03:17 +0100
** Changed in: lighttpd (Ubuntu Dapper)
Status: Fix Committed => Fix Released
--
CVE-2008-1270 when mod_userdir is loaded but not configured, the server's whole
disk becomes remotely readable
https://bugs.launchpad.net/bugs/200987
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
