CVE-2013-4559
CVE-2013-4559
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.
EPSS 10,7% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
n/a
- Versions du logiciel
- n/a: Concernée
Aucun correctif publié
lighttpd Debian:12
- Plages de versions concernées
- ECOSYSTEM: < 1.4.33-1+nmu1
Mettez à jour vers 1.4.33-1+nmu1
lighttpd Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 1.4.33-1+nmu1
Mettez à jour vers 1.4.33-1+nmu1
lighttpd Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 1.4.33-1+nmu1
Mettez à jour vers 1.4.33-1+nmu1
Sources originales
- http://secunia.com/advisories/55682
- http://marc.info/?l=bugtraq&m=141576815022399&w=2
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
- https://www.debian.org/security/2013/dsa-2795
- http://www.openwall.com/lists/oss-security/2013/11/12/4
- https://kc.mcafee.com/corporate/index?page=content&id=SB10310
- http://jvn.jp/en/jp/JVN37417423/index.html
- https://nvd.nist.gov/vuln/detail/CVE-2013-4559