Vulnerability Description
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lighttpd | Lighttpd | < 1.4.20 |
| Debian | Debian Linux | 4.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlThird Party Advisory
- http://openwall.com/lists/oss-security/2008/09/30/1Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/2Mailing List
- http://openwall.com/lists/oss-security/2008/09/30/3Mailing List
- http://secunia.com/advisories/32069Third Party Advisory
- http://secunia.com/advisories/32132Third Party Advisory
- http://secunia.com/advisories/32480Third Party Advisory
- http://secunia.com/advisories/32834Third Party Advisory
- http://secunia.com/advisories/32972Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200812-04.xmlThird Party Advisory
- http://trac.lighttpd.net/trac/changeset/2278Broken LinkVendor Advisory
- http://trac.lighttpd.net/trac/changeset/2307Broken LinkVendor Advisory
- http://trac.lighttpd.net/trac/changeset/2309Broken LinkVendor Advisory
- http://trac.lighttpd.net/trac/changeset/2310Broken LinkVendor Advisory
- http://trac.lighttpd.net/trac/ticket/1720Vendor Advisory
FAQ
What is CVE-2008-4359?
CVE-2008-4359 is a vulnerability with a CVSS score of 7.5 (HIGH). lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intende...
How severe is CVE-2008-4359?
CVE-2008-4359 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-4359?
Check the references section above for vendor advisories and patch information. Affected products include: Lighttpd Lighttpd, Debian Debian Linux.