Gentoo Linux Acme Thttpd文件访问信息泄露漏洞

Gentoo Linux是一个基于源码包的Linux系统。 Gentoo的www-servers/thttpd软件包实现上存在漏洞，远程攻击者可能利用此漏洞非授权获取敏感信息。 如果在新的Gentoo baselayout中使用start-stop-daemon命令的话，就会导致thttpd在启动时将文档根设置为系统的根目录“/”，这允许非授权用户远程访问thttpd进程可读的所有系统文件。 Gentoo Linux 1.12.6 临时解决方法：...

CVE-2007-0664

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

CVE-2007-0664

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

Directory traversal

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

PT-2007-2118 · Gentoo · Thttpd +1

Name of the Vulnerable Software and Affected Versions: thttpd versions prior to 2.25b-r6 Description: The issue allows remote attackers to read arbitrary files because thttpd is started from the system root directory / by the Gentoo baselayout 1.12.6 package. Recommendations: For versions prior t...

CVE-2007-0664

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

CVE-2007-0664: Undefined Security Weakness

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

CVE-2007-0664

CVE-2007-0664 affects thttpd prior to 2.25b-r6 when started from the system root (/) by Gentoo baselayout 1.12.6, causing the web server root to be "/" and enabling remote attackers to read arbitrary files. The underlying change to start-stop-daemon is cited in Gentoo GLSA 200701-28 and related a...

thttpd information leak

If thttpd is started from system root, system root is used as web server root directory...

[ GLSA 200701-28 ] thttpd: Unauthenticated remote file access

Gentoo Linux Security Advisory GLSA 200701-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

thttpd: Unauthenticated remote file access

Background thttpd is a webserver designed to be simple, small, and fast. Description thttpd is vulnerable to an underlying change made to the start-stop-daemon command in the current stable Gentoo baselayout package version 1.12.6. In the new version, the start-stop-daemon command performs a "chd...

[SECURITY] [DSA 1205-2] New thttpd packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1205-2 [email protected] http://www.debian.org/security/ Steve Kemp December 1sd, 2006 http://www.debian.org/security/faq -...

Debian DSA-1205-2 : thttpd - insecure temporary files

The original advisory for this issue didn't contain fixed packages for all supported architectures which are corrected in this update. For reference please find below the original advisory text : Marco d'Itri discovered that thttpd, a small, fast and secure webserver, makes use of insecure...

[SECURITY] [DSA-1205-1] New thttpd packages fix insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1205-1 [email protected] http://www.debian.org/security/ Steve Kemp November 2rd, 2006 http://www.debian.org/security/faq -...

thttpd symbolic links problem

Insecure temporary file creation on logfiles rotation...

[SECURITY] [DSA-1205-1] New thttpd packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1205-1 [email protected] http://www.debian.org/security/ Steve Kemp November 2rd, 2006 http://www.debian.org/security/faq -...

DSA-1205-1 thttpd - insecure temporary files

Bulletin has no description...

CVE-2006-4248

thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the startthttpd temporary file...

CVE-2006-4248

thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the startthttpd temporary file...

CVE-2006-4248

thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the startthttpd temporary file...