OSVDB ID: 48889

Title: lighttpd mod_userdir Filename Component Case Mismatch Remote Access Restriction Bypass

Info

Disclosure

Sep 30, 2008

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Location: Remote / Network Access
Impact: Loss of Integrity
Disclosure: Vendor Verified

Solution

Products

Unknown or Incomplete

References

CVE ID: 2008-4360 (see also: NVD)
Secunia Advisory ID: 32132 32480 32834 32972 33948 38152
Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
Vendor Specific Advisory URL: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00002.html
Other Advisory URL: http://openwall.com/lists/oss-security/2008/09/30/1
http://openwall.com/lists/oss-security/2008/09/30/2
http://openwall.com/lists/oss-security/2008/09/30/3
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309
http://www.debian.org/security/2008/dsa-1645
Vendor Specific News/Changelog Entry: http://trac.lighttpd.net/trac/changeset/2283
http://trac.lighttpd.net/trac/changeset/2308
http://trac.lighttpd.net/trac/ticket/1589
http://www.gentoo.org/security/en/glsa/glsa-200812-04.xml
http://www.lighttpd.net/security/lighttpd-1.4.x_userdir_lowercase.patch
http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt
RedHat RHSA: https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00364.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/48889