Published: 04/03/2008 Updated: 11/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote malicious users to obtain sensitive information.

Vulnerable Product	Search on Vulmon	Subscribe to Product
lighttpd lighttpd 1.4.18

Debian Bug report logs - #469307 lighttpd: CVE-2008-1111 reveals cgi source if the cgi handler fork fails Package: lighttpd; Maintainer for lighttpd is Debian QA Group <packages@qadebianorg>; Source for lighttpd is src:lighttpd (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Tue, 4 Mar 2008 1 ...

It was discovered that lighttpd, a fast webserver with minimal memory footprint, would display the source to CGI scripts if their execution failed in some circumstances For the stable distribution (etch), this problem has been fixed in version 1413-4etch5 For the unstable distribution, this problem will be fixed soon We recommend that you upgr ...

CWE-200 http://trac.lighttpd.net/trac/changeset/2107 https://bugs.gentoo.org/show_bug.cgi?id=211956 http://www.debian.org/security/2008/dsa-1513 https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html http://security.gentoo.org/glsa/glsa-200803-10.xml http://www.securityfocus.com/bid/28100 http://secunia.com/advisories/29209 http://secunia.com/advisories/29268 http://secunia.com/advisories/29275 http://secunia.com/advisories/29235 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106 https://issues.rpath.com/browse/RPL-2326 http://secunia.com/advisories/29318 http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html http://secunia.com/advisories/29622 http://www.vupen.com/english/advisories/2008/0763 https://exchange.xforce.ibmcloud.com/vulnerabilities/41008 http://www.securityfocus.com/archive/1/489465/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469307 https://nvd.nist.gov https://www.debian.org/security/./dsa-1513

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2008-1111

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect