mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.19. Therefore, it may be, affected by the following vulnerabilities :

  - lighttpd does not properly calculate the size of a file descriptor     array, which allows remote attackers to cause a denial of service     (crash) via a large number of connections, which triggers an     out-of-bounds access.

  - lighttpd sends the source code of CGI scripts instead of a 500     error when a fork failure occurs, which might allow remote     attackers to obtain sensitive information.

  - When userdir.path is not set, uses a default of $HOME, which     might allow remote attackers to read arbitrary files.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Remote attackers were able to crash lighttpd by opening     a large number of connections (CVE-2008-0983).

  - A bug in mod_cgi allowed remote attackers to read cgi     source files (CVE-2008-1111).

  - A bug in mod_userdir allowed remote attackers to read     arbitrary files (CVE-2008-1270).

The remote host is affected by the vulnerability described in GLSA-200803-10 (lighttpd: Multiple vulnerabilities)

    lighttpd contains a calculation error when allocating the global file     descriptor array (CVE-2008-0983). Furthermore, it sends the source of a     CGI script instead of returning a 500 error (Internal Server Error)     when the fork() system call fails (CVE-2008-1111).
  Impact :

    A remote attacker could exploit these vulnerabilities to cause a Denial     of Service or gain the source of a CGI script.
  Workaround :

    There is no known workaround at this time.

- Tue Mar 4 2008 Matthias Saou <http://freshrpms.net/>     1.4.18-6

    - Include patch for CVE-2008-0983 (crash when low on       file descriptors).

    - Include patch for CVE-2008-1111 (cgi source       disclosure).

    - Tue Feb 19 2008 Fedora Release Engineering <rel-eng at       fedoraproject.org>

    - Autorebuild for GCC 4.3

    - Wed Dec 5 2007 Release Engineering <rel-eng at       fedoraproject dot org>

    - Rebuild for deps

    - Wed Oct 31 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-3

    - Update mod_geoip source to fix segfault upon stopping       lighttpd.

    - Mon Oct 22 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-2

    - Include mod_geoip additional source, make it an       optional sub-package.

    - Reorder sub-packages alphabetically in spec file.

    - Make sub-packages require exact release, just in case.

    - Change default webroot back from /srv to /var.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Mar 4 2008 Matthias Saou <http://freshrpms.net/>     1.4.18-3

    - Include patch for CVE-2008-0983 (crash when low on       file descriptors).

    - Include patch for CVE-2008-1111 (cgi source       disclosure).

    - Tue Oct 16 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-2

    - Include mod_geoip additional source, make it an       optional sub-package.

    - Reorder sub-packages alphabetically in spec file.

    - Mon Sep 10 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-1

    - Update to 1.4.18.

    - Include newly installed lighttpd-angel ('angel'       process meant to always run as root and restart       lighttpd when it crashes, spawn processes on SIGHUP),       but it's in testing stage and must be run with -D for       now.

  - Wed Sep 5 2007 Matthias Saou <http://freshrpms.net/>     1.4.17-1

    - Update to 1.4.17.

    - Update defaultconf patch to match new example       configuration.

    - Include patch to fix log file rotation with       max-workers set (trac #902).

    - Add /var/run/lighttpd/ directory where to put fastcgi       sockets.

    - Thu Aug 23 2007 Matthias Saou <http://freshrpms.net/>       1.4.16-3

    - Add /usr/bin/awk build requirement, used to get       LIGHTTPD_VERSION_ID.

    - Wed Aug 22 2007 Matthias Saou <http://freshrpms.net/>       1.4.16-2

    - Rebuild to fix wrong execmem requirement on ppc32.

    - Thu Jul 26 2007 Matthias Saou <http://freshrpms.net/>       1.4.16-1

    - Update to 1.4.16 security fix release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that lighttpd, a fast webserver with minimal memory footprint, would display the source to CGI scripts if their execution failed in some circumstances.

The remote host is running Lighttpd, a small web server.  This version of Lighttpd is vulnerable to an information disclosure flaw.  The 'mod_cgi' module, when put under a considerable load, could fail to fork its process.  Such a failure would lead to the web server returning the source code of the CGI script that had been requested.  An attacker exploiting this flaw would be able to gain access to potentially confidential data.

ID	Name	Product	Family	Severity
106624	lighttpd < 1.4.19 Multiple Vulnerabilities	Nessus	Web Servers	medium
31775	openSUSE 10 Security Update : lighttpd (lighttpd-5107)	Nessus	SuSE Local Security Checks	medium
31385	GLSA-200803-10 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31372	Fedora 8 : lighttpd-1.4.18-6.fc8 (2008-2278)	Nessus	Fedora Local Security Checks	medium
31371	Fedora 7 : lighttpd-1.4.18-3.fc7 (2008-2262)	Nessus	Fedora Local Security Checks	medium
31360	Debian DSA-1513-1 : lighttpd - information disclosure	Nessus	Debian Local Security Checks	medium
4411	Lighttpd < 1.4.19 Information Disclosure	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2008-1111

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium