|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
Lighttpd contains a flaw that may allow a malicious user to display the source code of arbitrary scripts instead of generated response. The issue is triggered when processing specially crafted HTTP requests containing file extensions with unexpected capitalization. It is possible that the flaw may allow to bypass URL checks and obtain sensitive information resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Technical |
This issue can only be exploited on case insenstive file-systems like NTFS and FAT on Windows and HFS(+) on MacOSX operating systems.
|
|
Solution |
Upgrade to version 1.4.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
Lighttpd
 |
1.4.9 |
1.4.8 |
|
|
|
|
|
Credit |
- Schmidt Ryan - lighty-2006Q1
 ryandesign.com -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
