Sponsored link
Serve your customers, not your servers, with VERIO Linux VPS. Full-access test-drive here.
| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
lighttpd: information disclosure
| Package(s): | lighttpd | CVE #(s): | CVE-2008-1270 | ||||||||||||
| Created: | March 13, 2008 | Updated: | April 10, 2008 | ||||||||||||
| Description: | From the Mitre advisory: mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. | ||||||||||||||
| Alerts: |
| ||||||||||||||
(Log in to post comments)