1564 matches found
[Full-disclosure] rPSA-2007-0183-1 lighttpd
rPath Security Advisory: 2007-0183-1 Published: 2007-09-14 Products: rPath Linux 1 Rating: Severe Exposure Level Classification: Remote System User Deterministic Unauthorized Access Updated Versions: lighttpd=/conary.rpath.com@rpl:devel//1/1.4.18-0.1-1 References:...
FreeBSD : lighttpd -- FastCGI header overrun in mod_fastcgi (4b673ae7-5f9a-11dc-84dd-000102cc8983)
lighttpd maintainer reports : Lighttpd is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. For a detailed description of the bug see the external reference. This bug was found by Mattias Bengtsson and Philip...
DEBIAN-CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
Buffer overflow
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
CVE-2007-4727
Lighttpd is affected by CVE-2007-4727: a buffer overflow in the FastCGI extension (mod_fastcgi) through the fcgi_env_add path in mod_proxy_backend_fastcgi.c when handling overly long HTTP headers. The issue can overwrite CGI variables (notably SCRIPT_FILENAME) and may lead to remote code executio...
CVE-2007-4727: Improper Restriction of Operations within the Bounds of a Memory Buffer
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution
/ Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a "remove me" in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer="" localhost ./exploit localhost 80 /var/log/lighttpd/access.log Mattias Bengtsson...
Lighttpd <= 1.4.16 FastCGI Header Overflow Remote Exploit
Exploit for multiple platform in category remote exploits ========================================================= Lighttpd " localhost ./exploit localhost 80 /var/log/lighttpd/access.log Mattias Bengtsson http://www.secweb.se/ / include include include include include include include include...
Lighttpd <= 1.4.16 FastCGI Header Overflow Remote Exploit
No description provided by source. / Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a "remove me" in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer="?php system'/usr/bin/id'; ?" localhost ./exploit localhos...
Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution
Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution / Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a "remove me" in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer="" localhost ./exploit...
Lighttpd < 1.4.18 mod_fastcgi HTTP Request Header Overflow
Binary data 4206.prm...
lighttpd -- FastCGI header overrun in mod_fastcgi
lighttpd maintainer reports: Lighttpd is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. For a detailed description of the bug see the external reference. This bug was found by Mattias Bengtsson and Philip Olaus...
Debian DSA-1362-2 : lighttpd - several vulnerabilities
Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint, which could allow the execution of arbitrary code via the overflow of CGI variables when modfcgi was enabled. The Common Vulnerabilities and Exposures project identifies the following problems : -...
[SECURITY] [DSA 1362-1] New lighttpd packages fix several vulnerabilities
------------------------------------------------------------------------ Debian Security Advisory DSA-1362 [email protected] http://www.debian.org/security/ Steve Kemp August 29th, 2007 http://www.debian.org/security/faq - ------------------------------------------------------------------------...
DSA-1362-1 lighttpd - several vulnerabilities
Bulletin has no description...
GLSA-200708-11 : Lighttpd: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200708-11 Lighttpd: Multiple vulnerabilities Stefan Esser discovered errors with evidence of memory corruption in the code parsing the headers. Several independent researchers also reported errors involving the handling of HTTP...
[ GLSA 200708-11 ] Lighttpd: Multiple vulnerabilities
Gentoo Linux Security Advisory GLSA 200708-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...