[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 2 Mar 2008 23:47:17 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Robert Buchholz <rbu@...too.org>
cc: oss-security@...ts.openwall.com, coley@...re.org
Subject: Re: CVE request: lighttpd mod_cgi script source disclosure
On Mon, 3 Mar 2008, Robert Buchholz wrote:
> mod_cgi in lighttpd 1.4.18 (and earlier?) will send the source of a cgi
> script if it fails to fork the cgi handler, instead of an HTTP 500.
> mod_cgi is disabled by default.
>
> See for a patch:
> http://trac.lighttpd.net/trac/changeset/2107
> https://bugs.gentoo.org/show_bug.cgi?id=211956
Use CVE-2008-1111 - this will be public (in CVE) sometime on Monday.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
