1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 2649-1] lighttpd security update

    From Yves-Alexis Perez@1:229/2 to All on Fri Mar 15 22:40:01 2013
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2649-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez
    March 15, 2013 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : lighttpd
    Vulnerability : fixed socket name in world-writable directory
    Problem type : local
    Debian-specific: yes
    CVE ID : CVE-2013-1427
    Debian Bug :

    Stefan Bühler discovered that the Debian specific configuration file for lighttpd webserver FastCGI PHP support used a fixed socket name in the world-writable /tmp directory. A symlink attack or a race condition could be exploited by a malicious user on the same machine to take over the PHP control socket and for example force the webserver to use a different PHP version.

    As the fix is in a configuration file lying in /etc, the update won't be enforced if the file has been modified by the administrator. In that case, care should be taken to manually apply the fix.

    For the stable distribution (squeeze), this problem has been fixed in
    version 1.4.28-2+squeeze1.3.

    For the testing distribution (wheezy), this problem has been fixed in
    version 1.4.31-4.

    For the unstable distribution (sid), this problem has been fixed in
    version 1.4.31-4.

    We recommend that you upgrade your lighttpd packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v2.0.19 (GNU/Linux)

    iQEcBAEBCgAGBQJRQ5OpAAoJEG3bU/KmdcClChwH+gIPrukTLA2IOjdgXBPiRhS6 46rJ1yGtoSMscVeJ9ILgT5wWjj+wFiYf5cfgWUUqjfCq3TcOEXtioul3rCShq4ht zS+tp8CqltN80ZjXNzLV9X8ijvJ8tZyVRGFe+uroQSM3CUELU3Ykkeu7hr5EgQPE B8PvrOhrvnPcPUZG4m9Dh92BDfbzv2CRWY51KH6t1/ZZNUHTH208hwENpsOeut3X EbOGJzXgxWyWJCylnAc4Cp8WwCx36hhAU54msMyQxKu2NscGq8a4fmD3/uG98UjT dDD/UlcDGh35OT/+plP5QWnG7ZLCUfTJlAG352DiaV9zegVBJE3f74nbAuKLJI8=
    =CgMg
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)