CVE-2008-1111: Infoleak
Published Mar 4, 2008
·Updated
modcgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.
Affected Software
1 affected component
Lighttpd Lighttpd=1.4.18
Event History
Mar 4, 2008
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1111?
CVE-2008-1111 has a moderate severity rating due to the potential exposure of sensitive information.
2
How does CVE-2008-1111 affect lighttpd users?
CVE-2008-1111 allows attackers to gain access to the source code of CGI scripts instead of receiving an error message.
3
What versions of lighttpd are vulnerable to CVE-2008-1111?
CVE-2008-1111 specifically affects lighttpd version 1.4.18.
4
How do I fix CVE-2008-1111?
To mitigate CVE-2008-1111, upgrade lighttpd to a version later than 1.4.18.
5
What should I do if I am using lighttpd 1.4.18 and cannot upgrade?
If upgrading is not an option, consider rewriting your CGI scripts to handle errors more securely.