CVE-2005-0453

The bufferurldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 null character after the file extension...

lighttpd < 1.3.8 Null Byte Request CGI Script Source Code Disclosure

According to its banner, the version of lighttpd running on the remote host is prior to 1.3.8. It is, therefore, affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this vulnerability, by requesting a CGI script that is appended by a '%00', to read...

[Full-Disclosure] [ GLSA 200502-21 ] lighttpd: Script source disclosure

Gentoo Linux Security Advisory GLSA 200502-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

GLSA-200502-21 : lighttpd: Script source disclosure

The remote host is affected by the vulnerability described in GLSA-200502-21 lighttpd: Script source disclosure lighttpd uses file extensions to determine which elements are programs that should be executed and which are static pages that should be sent as-is. By appending %00 to the filename, yo...

Lighttpd < 1.3.8 CGI Source Disclosure

Binary data 2624.prm...

lighttpd: Script source disclosure

Background lighttpd is a small-footprint, fast, compliant and very flexible web-server which is optimized for high-performance environments. Description lighttpd uses file extensions to determine which elements are programs that should be executed and which are static pages that should be sent...

lighttpd -- script source disclosure vulnerability

The lighttpd website reports: In lighttpd 1.3.7 and below it is possible to fetch the source files which should be handled by CGI or FastCGI applications. The vulnerability is in the handling of urlencoded trailing NUL bytes. Installations that do not use CGI or FastCGI are not affected...

lighttpd < 1.4.24 Information Disclosure

Binary data 5035.prm...

Multiple Web Server ~nobody/ Request Arbitrary File Access

It is possible to access arbitrary files on the remote web server by appending nobody/ in front of their name as in nobody/etc/passwd. This problem is due to a misconfiguration in the web server that sets 'UserDir' or its equivalent to './'. C Tenable Network Security, Inc. include"compat.inc";...