Lucene search

K
osvGoogleOSV:DSA-1205-1
HistoryNov 02, 2006 - 12:00 a.m.

thttpd - insecure temporary files

2006-11-0200:00:00
Google
osv.dev
8

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

The original advisory for this issue didn’t contain fixed packages for all
supported architectures which are corrected in this update. For reference
please find below the original advisory text:

>
> Marco d’Itri discovered that thttpd, a small, fast and secure webserver,
> makes use of insecure temporary files when its logfiles are rotated,
> which might lead to a denial of service through a symlink attack.
>
>
>

For the stable distribution (sarge) this problem has been fixed in
version 2.23beta1-3sarge2.

For the unstable distribution (sid) this problem has been fixed in
version 2.23beta1-5.

We recommend that you upgrade your thttpd package.

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C