*** This bug is a security vulnerability *** Public security bug reported:
mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. http://trac.lighttpd.net/trac/ticket/1587 http://trac.lighttpd.net/trac/changeset/2120 ** Affects: lighttpd (Ubuntu) Importance: Undecided Status: Confirmed ** Affects: lighttpd (Ubuntu Dapper) Importance: Undecided Status: Confirmed ** Affects: lighttpd (Ubuntu Edgy) Importance: Undecided Status: Confirmed ** Affects: lighttpd (Ubuntu Feisty) Importance: Undecided Status: Confirmed ** Affects: lighttpd (Ubuntu Gutsy) Importance: Undecided Status: Confirmed ** Affects: lighttpd (Ubuntu Hardy) Importance: Undecided Status: Confirmed ** Visibility changed to: Public -- CVE-2008-1270 when mod_userdir is loaded but not configured, the server's whole disk becomes remotely readable https://bugs.launchpad.net/bugs/200987 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
