CVE-2013-4559
First published: Tue Nov 19 2013(Updated: )
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/lighttpd | 1.4.53-4+deb10u2 1.4.53-4+deb10u3 1.4.59-1+deb11u2 1.4.69-1 | |
| Fipsasp Fipscms Light | <1.4.33 | |
| Debian | =6.0 | |
| Debian | =7.0 | |
| Debian | =8.0 | |
| SUSE Linux | =12.2 | |
| SUSE Linux | =12.3 | |
| SUSE Linux | =13.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2013-4559
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt
- http://jvn.jp/en/jp/JVN37417423/index.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
- http://marc.info/?l=bugtraq&m=141576815022399&w=2
- http://secunia.com/advisories/55682
- http://www.openwall.com/lists/oss-security/2013/11/12/4
- https://kc.mcafee.com/corporate/index?page=content&id=SB10310
- https://www.debian.org/security/2013/dsa-2795
Frequently Asked Questions
What is the severity of CVE-2013-4559?
CVE-2013-4559 is considered a high severity vulnerability due to the potential for privilege escalation.
What systems are affected by CVE-2013-4559?
CVE-2013-4559 affects lighttpd versions before 1.4.33 across various Linux distributions including Debian and openSUSE.
How do I fix CVE-2013-4559?
To fix CVE-2013-4559, upgrade lighttpd to version 1.4.33 or later.
What can attackers do with CVE-2013-4559?
Attackers can exploit CVE-2013-4559 to gain root privileges through improper function return value checks.
Is there a workaround for CVE-2013-4559?
There are no effective workarounds for CVE-2013-4559; patching the vulnerability is recommended.
- collector/security-tracker-debian
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/lighttpd
- canonical/fipsasp fipscms light
- vendor/debian
- canonical/debian
- version/debian/6.0
- version/debian/7.0
- version/debian/8.0
- vendor/opensuse
- canonical/suse linux
- version/suse linux/12.2
- version/suse linux/12.3
- version/suse linux/13.1