mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.19. Therefore, it may be, affected by the following vulnerabilities :

  - lighttpd does not properly calculate the size of a file descriptor     array, which allows remote attackers to cause a denial of service     (crash) via a large number of connections, which triggers an     out-of-bounds access.

  - lighttpd sends the source code of CGI scripts instead of a 500     error when a fork failure occurs, which might allow remote     attackers to obtain sensitive information.

  - When userdir.path is not set, uses a default of $HOME, which     might allow remote attackers to read arbitrary files.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200804-08 (lighttpd: Multiple vulnerabilities)

    Julien Cayzax discovered that an insecure default setting exists in     mod_userdir in lighttpd. When userdir.path is not set the default value     used is $HOME. It should be noted that the 'nobody' user's $HOME is '/'     (CVE-2008-1270). An error also exists in the SSL connection code which     can be triggered when a user prematurely terminates his connection     (CVE-2008-1531).
  Impact :

    A remote attacker could exploit the first vulnerability to read     arbitrary files. The second vulnerability can be exploited by a remote     attacker to cause a Denial of Service by terminating a victim's SSL     connection.
  Workaround :

    As a workaround for CVE-2008-1270 you can set userdir.path to a     sensible value, e.g. 'public_html'.

- Remote attackers were able to crash lighttpd by opening     a large number of connections (CVE-2008-0983).

  - A bug in mod_cgi allowed remote attackers to read cgi     source files (CVE-2008-1111).

  - A bug in mod_userdir allowed remote attackers to read     arbitrary files (CVE-2008-1270).

Julien Cayzac discovered that under certain circumstances lighttpd, a fast webserver with minimal memory footprint, might allow the reading of arbitrary files from the system. This problem could only occur with a non-standard configuration.

The remote host is running Lighttpd, a small web server.  This version of Lighttpd is vulnerable to an information disclosure flaw.  The 'mod_cgi' module, when put under a considerable load, could fail to fork its process.  Such a failure would lead to the web server returning the source code of the CGI script that had been requested.  An attacker exploiting this flaw would be able to gain access to potentially confidential data.

ID	Name	Product	Family	Severity
106624	lighttpd < 1.4.19 Multiple Vulnerabilities	Nessus	Web Servers	medium
31955	GLSA-200804-08 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31775	openSUSE 10 Security Update : lighttpd (lighttpd-5107)	Nessus	SuSE Local Security Checks	medium
31592	Debian DSA-1521-1 : lighttpd - file disclosure	Nessus	Debian Local Security Checks	medium
4411	Lighttpd < 1.4.19 Information Disclosure	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2008-1270

high

Tenable Plugins

medium

medium

medium

medium

medium