CVE-2006-0760: Low severity Lighttpd Lighttpd vulnerability

Published Feb 18, 2006

Updated

LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.

Affected Software

47 affected components

Lighttpd Lighttpd=1.4.3

Lighttpd Lighttpd=1.2.3

Lighttpd Lighttpd=1.2.5

Lighttpd Lighttpd=1.3.6

Lighttpd Lighttpd=1.3.12

Lighttpd Lighttpd=1.3.15

Lighttpd Lighttpd=1.4.1

Lighttpd Lighttpd=1.2.2

Lighttpd Lighttpd=1.3.0

Lighttpd Lighttpd=1.0.3

Lighttpd Lighttpd=1.4.8

Lighttpd Lighttpd=1.1.6

Lighttpd Lighttpd=1.4.4

Lighttpd Lighttpd=1.1.5

Lighttpd Lighttpd=1.3.9

Lighttpd Lighttpd=1.2.4

Lighttpd Lighttpd=1.3.5

Lighttpd Lighttpd=1.1.1

Lighttpd Lighttpd=1.2.8

Lighttpd Lighttpd=1.3.13

Lighttpd Lighttpd=1.2.6

Lighttpd Lighttpd=1.3.4

Lighttpd Lighttpd=1.4.2

Lighttpd Lighttpd=1.2.1

Lighttpd Lighttpd=1.3.14

Lighttpd Lighttpd=1.1.4

Lighttpd Lighttpd=1.1.9

Lighttpd Lighttpd=1.1.3

Lighttpd Lighttpd=1.4.5

Lighttpd Lighttpd=1.1.0

Lighttpd Lighttpd=1.3.3

Lighttpd Lighttpd=1.3.8

Lighttpd Lighttpd=1.0.2

Lighttpd Lighttpd=1.1.7

Lighttpd Lighttpd=1.2.0

Lighttpd Lighttpd=1.1.8

Lighttpd Lighttpd=1.3.11

Lighttpd Lighttpd=1.3.16

Lighttpd Lighttpd=1.3.1

Lighttpd Lighttpd=1.3.10

Lighttpd Lighttpd=1.1.2

Lighttpd Lighttpd=1.4.7

Lighttpd Lighttpd=1.4.6

Lighttpd Lighttpd=1.2.7

Lighttpd Lighttpd=1.3.7

Lighttpd Lighttpd=1.3.2

Lighttpd Lighttpd=1.4.0

Remediation

Patch Available

http://secunia.com/advisories/18869

Event History

Feb 18, 2006

CVE Published

02:02 AM

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0760?

CVE-2006-0760 has been classified as a medium severity vulnerability due to its potential to expose sensitive information without proper authorization.

How do I fix CVE-2006-0760?

To fix CVE-2006-0760, upgrade to LightTPD version 1.4.9 or later, which addresses this vulnerability.

What versions of LightTPD are affected by CVE-2006-0760?

CVE-2006-0760 affects LightTPD versions 1.4.8 and earlier.

What kind of attacks can exploit CVE-2006-0760?

Attackers can exploit CVE-2006-0760 by manipulating URL file extensions with unexpected capitalization to bypass security checks.

Is CVE-2006-0760 a critical vulnerability?

No, CVE-2006-0760 is not considered critical, but it can still lead to the exposure of sensitive information.