CVE-2008-1270

Related Files

Gentoo Linux Security Advisory 200804-8

Posted Apr 10, 2008

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory GLSA 200804-08 - Julien Cayzax discovered that an insecure default setting exists in mod_userdir in lighttpd. When userdir.path is not set the default value used is $HOME. It should be noted that the nobody user's $HOME is / (CVE-2008-1270). An error also exists in the SSL connection code which can be triggered when a user prematurely terminates his connection (CVE-2008-1531). Versions less than 1.4.19-r2 are affected.

tags | advisory

systems | linux, gentoo

advisories | CVE-2008-1270, CVE-2008-1531

SHA-256 | 04d53fca65adca4c84d85a814f6f371863f45711fbaaacda55d307182040adff

Download | Favorite | View

Debian Linux Security Advisory 1521-1

Posted Mar 17, 2008

Authored by Debian | Site debian.org

Debian Security Advisory 1521-1 - Julien Cayzac discovered that under certain circumstances lighttpd, a fast webserver with minimal memory footprint, might allow the reading of arbitrary files from the system. This problem could only occur with a non-standard configuration.

tags | advisory, arbitrary

systems | linux, debian

advisories | CVE-2008-1270

SHA-256 | 2840b96eb72ba9b88300f61440b5bb9afc752ee4c42cf701dbde09e00d348215

Download | Favorite | View