5 - CVE-2008-1111

Executive Summary

Informations
Name	CVE-2008-1111	First vendor Publication	2008-03-04
Vendor	Cve	Last vendor Modification	2018-10-11

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1111

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-200	Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20397

Oval ID:	oval:org.mitre.oval:def:20397
Title:	DSA-1513-1 lighttpd - information disclosure
Description:	It was discovered that lighttpd, a fast webserver with minimal memory footprint, would display the source to CGI scripts if their execution failed in some circumstances.
Family:	unix	Class:	patch
Reference(s):	DSA-1513-1 CVE-2008-1111	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	lighttpd
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND lighttpd DPKG is earlier than 0:1.4.13-4etch5

Definition Id: oval:org.mitre.oval:def:7977

Oval ID:	oval:org.mitre.oval:def:7977
Title:	DSA-1513 lighttpd -- information disclosure
Description:	It was discovered that lighttpd, a fast webserver with minimal memory footprint, would display the source to CGI scripts if their execution failed in some circumstances.
Family:	unix	Class:	patch
Reference(s):	DSA-1513 CVE-2008-1111	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	lighttpd
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND lighttpd-doc is earlier than 1.4.13-4etch5 AND lighttpd-mod-mysql-vhost is earlier than 1.4.13-4etch5 AND lighttpd-mod-magnet is earlier than 1.4.13-4etch5 AND lighttpd is earlier than 1.4.13-4etch5 AND lighttpd-mod-cml is earlier than 1.4.13-4etch5 AND lighttpd-mod-webdav is earlier than 1.4.13-4etch5 AND lighttpd-mod-trigger-b4-dl is earlier than 1.4.13-4etch5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Lighttpd cpe:2.3:a:lighttpd:lighttpd:1.4.18:::::::*	1

OpenVAS Exploits

Date	Description
2009-02-17	Name : Fedora Update for lighttpd FEDORA-2008-3343 File : nvt/gb_fedora_2008_3343_lighttpd_fc7.nasl
2009-02-17	Name : Fedora Update for lighttpd FEDORA-2008-3376 File : nvt/gb_fedora_2008_3376_lighttpd_fc8.nasl
2009-02-16	Name : Fedora Update for lighttpd FEDORA-2008-2262 File : nvt/gb_fedora_2008_2262_lighttpd_fc7.nasl
2009-02-16	Name : Fedora Update for lighttpd FEDORA-2008-2278 File : nvt/gb_fedora_2008_2278_lighttpd_fc8.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200803-10 (lighttpd) File : nvt/glsa_200803_10.nasl
2008-03-11	Name : Debian Security Advisory DSA 1513-1 (lighttpd) File : nvt/deb_1513_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
43169	lighttpd mod_cgi Fork Failure CGI Source Disclosure

Nessus® Vulnerability Scanner

Date	Description
2018-02-06	Name : The remote web server is affected by multiple vulnerabilities File : lighttpd_1_4_19.nasl - Type : ACT_GATHER_INFO
2008-04-04	Name : The remote openSUSE host is missing a security update. File : suse_lighttpd-5107.nasl - Type : ACT_GATHER_INFO
2008-03-07	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1513.nasl - Type : ACT_GATHER_INFO
2008-03-07	Name : The remote Fedora host is missing a security update. File : fedora_2008-2262.nasl - Type : ACT_GATHER_INFO
2008-03-07	Name : The remote Fedora host is missing a security update. File : fedora_2008-2278.nasl - Type : ACT_GATHER_INFO
2008-03-07	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200803-10.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/28100
BUGTRAQ	http://www.securityfocus.com/archive/1/489465/100/0/threaded
CONFIRM	http://trac.lighttpd.net/trac/changeset/2107 https://bugs.gentoo.org/show_bug.cgi?id=211956
DEBIAN	http://www.debian.org/security/2008/dsa-1513
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html
GENTOO	http://security.gentoo.org/glsa/glsa-200803-10.xml
MISC	http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0106 https://issues.rpath.com/browse/RPL-2326
SECUNIA	http://secunia.com/advisories/29209 http://secunia.com/advisories/29235 http://secunia.com/advisories/29268 http://secunia.com/advisories/29275 http://secunia.com/advisories/29318 http://secunia.com/advisories/29622
SUSE	http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
VUPEN	http://www.vupen.com/english/advisories/2008/0763
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/41008

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:07:12	Multiple Updates
2021-04-22 01:07:37	Multiple Updates
2020-05-23 00:21:21	Multiple Updates
2018-10-12 00:20:15	Multiple Updates
2017-08-08 09:23:54	Multiple Updates
2016-04-26 17:11:04	Multiple Updates
2014-02-17 10:44:04	Multiple Updates
2013-05-11 00:11:10	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	1
Sources(s)	19
osvdb(s)	1
Openvas Exploit(s)	6
Nessus® Exploit(s)	6

	Related
5	GLSA-200803-10
5	DSA-1513
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0402s

Facebook rss twitter linkedin mail