oss-security - Re: CVE request: yet another lighttpd issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 10 Mar 2008 16:44:50 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Jonathan Smith <smithj@...ethemallocs.com>
cc: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: yet another lighttpd issue


======================================================
Name: CVE-2008-1270
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1270
Reference: CONFIRM:http://trac.lighttpd.net/trac/ticket/1587
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=212930
Reference: CONFIRM:https://issues.rpath.com/browse/RPL-2344

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not
set, uses a default of $HOME, which might allow remote attackers to
read arbitrary files, as demonstrated by accessing the ~nobody
directory.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.