Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
91
security advisorygentooremote accessGentoo: GLSA-200701-28 Low: thttpd Unauthenticated Remote Access
The default configuration of the Gentoo thttpd package potentially allows unauthenticated access to system files when used with newer versions of baselayout. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200701-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: thttpd: Unauthenticated remote file access Date: January 31, 2007 Bugs: #142047 ID: 200701-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The default configuration of the Gentoo thttpd package potentially allows unauthenticated access to system files when used with newer versions of baselayout. Background ========= thttpd is a webserver designed to be simple, small, and fast. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/thttpd < 2.25b-r6 > = 2.25b-r6 Description ========== thttpd is vulnerable to an underlying change made to the start-stop-daemon command in the current stable Gentoo baselayout package (version 1.12.6). In the new version, the start-stop-daemon command performs a "chdir /" command just before starting the thttpd process. In the Gentoo default configuration, this causes thttpd to start with the document root set to "/", the sytem root directory. Impact ===== When thttpd starts with the document root set to the system root directory, all files on the system that are readable by the thttpd process can be remotely accessed by unauthenticated users. Workaround ========= Alter the THTTPD_OPTS variable in /etc/conf.d/thttpd to includethe "-d" option to specify the document root. Alternatively, modify the THTTPD_OPTS variable in /etc/conf.d/thttpd to specify a thttpd.conf file using the "-C" option, and then configure the "dir=" directive in that thttpd.conf file. Resolution ========= All thttpd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-servers/thttpd-2.25b-r5" Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200701-28 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jan 31, 2007
•Low
Gentoo
87
security advisoryDebianDoS attackDebian Sarge: DSA 1205-2 Moderate: Thttpd Symlink Vulnerability
Marco d'Itri discovered that thttpd, a small, fast and secure webserver, makes use of insecure temporary files when its logfiles are rotated, which might lead to a denial of service through a symlink attack. The original advisory for this issue didn't contain fixed packages for all supported architectures which are corrected in this update. . - --------------------------------------------------------------------------Debian Security Advisory DSA 1205-2
Dec 01, 2006
•Important
Debian
87
security advisorydenial of servicedebianDebian: DSA-1205-1 Critical: Thttpd Insecure Temporary File Handling
Marco d'Itri discovered that thttpd, a small, fast and secure webserver, makes use of insecure temporary files when its logfiles are rotated, which might lead to a denial of service through a symlink attack.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1205-1
Nov 03, 2006
•Critical
Debian
87
security advisorycriticalDebianDebian: DSA 883-2 Critical: Rsync Insecure Directory Permissions Flaw
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 883-1
Nov 04, 2005
•Critical
Debian
100
security advisoryinformation leakremote escalationSUSE 7.3-9.0: 2003-045 Moderate: nginx Network Vulnerability Assessment
Two vulnerabilities were found in the "tiny" web-server thttpd. Two vulnerabilities were found in the "tiny" web-server thttpd. The first bug is a buffer overflow that can be exploited remotely The first bug is a buffer overflow that can be exploited remotely to overwrite the EBP register of the stack. Due to memory-alignment of the stack done by gcc 3.x this bug can not be exploited. All th [More...]. -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: thttpd Announcement-ID: SuSE-SA:2003:044 Date: Friday, Oct 31st 2003 13:04 MEST Affected products: 7.3, 8.0, 8.1, 8.2, 9.0 Vulnerability Type: remote privilege escalation/ information leak Severity (1-10): 5 SUSE default package: no Cross References: CAN-2003-0899 CAN-2002-1562 Content of this advisory: 1) security vulnerability resolved: - buffer overflow - information leak (virtual hosting) problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - libnids - KDE - postgresql - frox - sane - ircd - fileutils - mc - apache1/2 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Two vulnerabilities were found in the "tiny" web-server thttpd. The first bug is a buffer overflow that can be exploited remotely to overwrite the EBP register of the stack. Due to memory-alignment of the stack done by gcc 3.x this bug can not be exploited. All thttpd versionsmentioned in this advisory are compiled with gcc 3.x and are therefore not exploitable. The other bug occurs in the virtual-hosting code of thttpd. A remote attacker can bypass the virtual-hosting mechanism to read arbitrary files. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-9.0: e33f3897cac1e1fe117eff8ca252ec0f patch rpm(s): cd5c2aeb6d31d6a6781f392af17a4989 source rpm(s): c6e2446bc94c8c00d35b7741b67df678 SuSE-8.2: a491b55f562fa0f3b1679ee819140c72 patch rpm(s): bbb3dd624b19d8683223049a070d4cf2 source rpm(s): 2710751ff1ee8fbab3c2934c5cb09f3d SuSE-8.1: 428db4fb2eccebb5ed16cb28161ba2a5 patch rpm(s): b32fb0a87d8d7de3ed1953e64da89bc8 source rpm(s): e64bc1488747a414f6bd60735f82385f SuSE-8.0: 952dcca179b647afdeea02b987e3daf8 patch rpm(s): e596221f34a73ba6fdd29abcecb6e211 source rpm(s): 8500be9c635d1c5c9618ecca2a09a5e7 SuSE-7.3: 16ffc5238c1f57b8a1e6e02989524e82 source rpm(s): b5c4b9c65182fcd2a326e3edad7b2dfb PPC Power PC Platform: SuSE-7.3: e7aaff82bd90c459849dd78b1cc47515 source rpm(s): 8ac31eb38063a891e37ed327a5ddbc0c ______________________________________________________________________________ 2) Pending vulnerabilities in SUSE Distributions and Workarounds: - libnids New libnids packages were released to stop remote command execution due to a memory corruption in the TCP reassembly code. (CAN-2003-0850) Please download them from our FTP servers. - KDE New KDE packages are currentlybeing tested. These packages fixes several vulnerabilities: + remote root compromise (CAN-2003-0690) + weak cookies (CAN-2003-0692) + SSL man-in-the-middle attack + information leak through HTML-referrer (CAN-2003-0459) The packages will be release as soon as testing is finished. - postgresql Several buffer overflow problems were fixed in the pg_to_asci() function of postgresql server. New packages are available on our FTP servers. - frox A denial-of-service attack in frox can be trigger remotely. The packages are currently tested and will be release as soon as possible. - sane The scanner service sane of SuSE Linux 7.3-8.1 is vulnerable to a remote denial-of-service attack. This attack can even be triggered if the attackers host is not listed in the saned.conf file. The packages are currently tested and will be release as soon as possible. - ircd The Internet Relay Chat daemon is vulnerable to a remote denial-of- service attack. The attack can be triggered by irc clients directly connected to the daemon. The packages are currently tested and will be release as soon as possible. - fileutils A local denial-of-service attack can be triggered by abusing the -w option of ls(1). This attack can be turned into a remote denial-of- service by using network services, like wuftpd, that rely on the ls(1) command installed on the system. The packages are currently tested and will be release as soon as possible. - mc By using a special combination of links in archive-files it is possible to execute arbitrary commands while mc tries to open it in its VFS. The packages are currently tested and will be release as soon as possible. - apache1/2 The widely used HTTP server apache has several security vulnerabilities: - locally exploitable buffer overflow in the regular expression code. The attacker must be able to modify .htaccess or httpd.conf. (affects: mod_alias and mod_rewrite) - under some circumstances mod_cgid will output its data to the wrong client (affects: apache2) ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Oct 31, 2003
SuSE
87
security advisoryinformation leakcriticalDebian DSA 396-1 Critical: thttpd Information Leak And Remote Execution
An information leak and an arbitrary code execution vulnerability have been fixed.. - -------------------------------------------------------------------------- Debian Security Advisory DSA 396-1
Oct 29, 2003
•Critical
Debian
100
security advisorycriticalSuSESuSE: thttpd 1.90a - 2.04 Critical Remote Code Execution Threat
The thttpd web server doesn't do proper bounds checking in the date parsing function tdate_parse(). . _____________________________________________________________________________ SuSE Security Announcement - thttpd Package: thttpd 1.90a - 2.04 Date: Tue Nov 16 19:44:14 CET 1999 Affected SuSE versions: 6.2 and 6.3 Vulnerability Type: remote compromise SuSE default package: no Other affected systems: all unix systems using the thttpd-server ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The thttpd web server doesn't do proper bounds checking in the date parsing function tdate_parse(). 2. Impact By overflowing a static buffer in tdate_parse() an attacker could remotely execute commands on the thttpd host with the permissions of thttpd. 3. Solution Updated the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: 160a166713f186a61b2111c45786e26a thttpd-2.04-31.i386.rpm (6.2) 4eb85acb72a30873842257cd923f9332 thttpd-2.04-31.i386.rpm (6.3) ______________________________________________________________________________ You can find updates on our ftp-Server: or try the following webpages for a list of mirrors: https://www.suse.com/de-de/ Our webpage for patches: https://www.suse.com/de-de/ Our webpage for security announcements: https://www.suse.com/de-de/ If you want to report vulnerabilities, please contact
Dec 08, 1999
•Critical
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!