Debian: New lighttpd packages fix arbitrary file disclosure

    Date 16 Mar 2008
    Posted By LinuxSecurity Advisories
    Julien Cayzac discovered that under certain circumstances lighttpd, a fast webserver with minimal memory footprint, might allow the reading of arbitrary files from the system. This problem could only occur with a non-standard configuration.
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1521-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.                               Steve Kemp
    March 16, 2008              
    - ------------------------------------------------------------------------
    Package        : lighttpd
    Vulnerability  : file disclosure
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2008-1270
    Julien Cayzac discovered that under certain circumstances lighttpd,
    a fast webserver with minimal memory footprint, might allow the reading
    of arbitrary files from the system.  This problem could only occur
    with a non-standard configuration.
    For the stable distribution (etch), this problem has been fixed in 
    version 1.4.13-4etch6.
    We recommend that you upgrade your lighttpd package.
    Upgrade instructions
    - --------------------
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    Source archives:
        Size/MD5 checksum:     1098 3e5a62a7162734998177e8707d2dba02
        Size/MD5 checksum:    37066 853e653e4b56e0065b7d072bfdb038b9
    Architecture independent packages:
        Size/MD5 checksum:    99510 38af003d4b49531a371c58eec8c92797
    alpha architecture (DEC Alpha)
        Size/MD5 checksum:    61252 f9a572ac4ece6cda80883e9ece59cf99
        Size/MD5 checksum:    64492 6d0802043b33391abf217b605ade53c6
        Size/MD5 checksum:   318848 64225fd5e10a77386763b28a3fa6b310
        Size/MD5 checksum:    71726 8797d97bd147f2f502741d790d42781e
        Size/MD5 checksum:    59494 5537c07a1bf16c607d42cbb24af35b0e
        Size/MD5 checksum:    64924 e179a9988bc2b04a0188301040f7eb02
    amd64 architecture (AMD x86_64 (AMD64))
        Size/MD5 checksum:    60662 281bac93cddf6ed6fcd907dac5eb0720
        Size/MD5 checksum:    69818 74394f7d4528636f962133efa4a738da
        Size/MD5 checksum:    63506 b336b9d3d1836d2d06c5feaaefb8366e
        Size/MD5 checksum:    63806 6613f85008260c83222a2b5a8d183d50
        Size/MD5 checksum:   297130 9a00e9837f11cb5647491e28bf8da877
        Size/MD5 checksum:    59060 1b1864819d7892f9dc1834ece83ba39f
    arm architecture (ARM)
        Size/MD5 checksum:    62786 e91afeac0b95ae32d9c346bf8b56ff2b
        Size/MD5 checksum:    69506 928bd56baa76d302d2637c3edafa966a
        Size/MD5 checksum:    58604 e060ddc287c0f62485c3b450f781a9c5
        Size/MD5 checksum:   286248 6915b4c299334a0aa608e69016579947
        Size/MD5 checksum:    60736 c1dba99fad76965ea148addcedbe8d1e
        Size/MD5 checksum:    62996 441fe045d312d83cd9c0abfea000fd04
    hppa architecture (HP PA RISC)
        Size/MD5 checksum:    65382 9891f2e251cba3716cc7318244f12191
        Size/MD5 checksum:    64926 32155b4baafa529b01f8fa93d35c1016
        Size/MD5 checksum:   324246 b391c9f49db494a231b2c6bbe6b0a17c
        Size/MD5 checksum:    61704 a445b749e09728bbcc7aa2810262c316
        Size/MD5 checksum:    72912 f1b011512b9ffe681684aedc1100fd96
        Size/MD5 checksum:    59856 e4d9e12d39cedc57301dec75d3f0f9bc
    i386 architecture (Intel ia32)
        Size/MD5 checksum:    70858 38d84f5a4dc0b5e98d8c4d8753720721
        Size/MD5 checksum:    59004 e89b0b96998623b78e0e756ecb5c64e5
        Size/MD5 checksum:    63614 3f91b5416bade664bac825c5f55b1760
        Size/MD5 checksum:    63810 f5c6a0fe13e228a2c97f7c0f9134139f
        Size/MD5 checksum:   288986 020ae1cd38f72be751c3d2339322e37d
        Size/MD5 checksum:    60764 6a866a4be8bb00bc89a19fd923892ac3
    ia64 architecture (Intel ia64)
        Size/MD5 checksum:    67428 8057dbf996587a0dab7dfb830149596a
        Size/MD5 checksum:    67270 47e8df0e90b8a94399140f8e094cf193
        Size/MD5 checksum:    76970 3ec5566bf7884996d3b2c1cff05934d3
        Size/MD5 checksum:    62972 9eba69d6fbceecf7ab25847fe6123d45
        Size/MD5 checksum:   403368 49e9eeff7722157ec9240b693bdd7a8b
        Size/MD5 checksum:    61096 a431a7e8cc1ed5e7c03a986062a71cb6
    mips architecture (MIPS (Big Endian))
        Size/MD5 checksum:    59854 8a771e4cf424fc2db2ea32cc2e51e97b
        Size/MD5 checksum:   296016 08c0da736b8529d6a76cfc3cd482b2e9
        Size/MD5 checksum:    62442 8f42b63450914e64e2eee69b4bdbfe90
        Size/MD5 checksum:    69146 2bc52d53fb5fe04fb1252c31b280a418
        Size/MD5 checksum:    62562 bd6ea27d76c2c61e3c744b4f9bdb00ce
        Size/MD5 checksum:    58480 939cbd552f397780de40b834908b7130
    mipsel architecture (MIPS (Little Endian))
        Size/MD5 checksum:    69928 9ac409e25d6e7b9e4b1cb4ad13ed9632
        Size/MD5 checksum:    60680 343e11ab45cab336396806f7f221945d
        Size/MD5 checksum:    63286 886e4bc3478309c1656f7d6bd977f2ed
        Size/MD5 checksum:    59192 e4cc8d162b281518d52a739eb318f041
        Size/MD5 checksum:   297128 89cdce8b7cd2690e28b95c3d783c9154
        Size/MD5 checksum:    63450 36f870435ee48223a8ced7e6613a169d
    powerpc architecture (PowerPC)
        Size/MD5 checksum:    60566 d4b1ad36213cbdf6065f239aa472b498
        Size/MD5 checksum:    65034 845332f6d09f3f0692a6d18963dcfcc4
        Size/MD5 checksum:    62380 6466c3be37fe7fe26f7e83b3c2ead222
        Size/MD5 checksum:    65306 aaaefd16bdf02e178aee3343c18cc17d
        Size/MD5 checksum:    71682 a4bb5ec71a26f40b0a5cef12bb850a40
        Size/MD5 checksum:   323712 eb5edc0b82555ec99996121925c4d0ab
    s390 architecture (IBM S/390)
        Size/MD5 checksum:    60994 4f546530cae504799f369f806d00eb51
        Size/MD5 checksum:   307112 25b76d9b1971949e8091e2c4c0430c58
        Size/MD5 checksum:    64160 30ad6c09af94176abd6fb010ee66bb25
        Size/MD5 checksum:    64548 c03eed9df63c727831ff4993703b98c0
        Size/MD5 checksum:    71274 b8a2712beb266769a25219bcaccceeac
        Size/MD5 checksum:    59486 706725ae2ff5257a52467e7db30c0a14
    sparc architecture (Sun SPARC/UltraSPARC)
        Size/MD5 checksum:    69798 d85012884750a5d423d2761f62dd2ec9
        Size/MD5 checksum:    60434 cad01450236fec8a2a57504aea63426c
        Size/MD5 checksum:    63344 ebf4c95b0d1cfc06e3d37afad107afd4
        Size/MD5 checksum:    58776 76a058d44cef9963903648eefef0fa7a
        Size/MD5 checksum:    63322 5d433e4a4b0801256be2170bf0ba3931
        Size/MD5 checksum:   284060 2c0aafcaa9c5490e8ae9f8e73d7b7a22
      These files will probably be moved into the stable distribution on
      its next update.
    - ---------------------------------------------------------------------------------
    For apt-get: deb stable/updates main
    For dpkg-ftp: dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.

    LinuxSecurity Poll

    How do you feel about the elimination of the terms 'blacklist' and 'slave' from the Linux kernel?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    [{"id":"112","title":"I strongly support this change - racially charged language should not be used in the code and documentation of the kernel and other open-source projects.","votes":"6","type":"x","order":"1","pct":19.35,"resources":[]},{"id":"113","title":"I'm indifferent - this small change will not affect broader issues of racial insensitivity and white privilege.","votes":"4","type":"x","order":"2","pct":12.9,"resources":[]},{"id":"114","title":"I'm opposed to this change - there is no need to change language that has been used for years. It doesn't make sense for people to take offense to terminology used in community projects.","votes":"21","type":"x","order":"3","pct":67.74,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.