Advisories:rPSA-2008-0106

From rPath Wiki

rPath Security Advisory 2008-0106-1

Published: 2008-03-12

Products

• rPath Linux 1

Rating

Severe

Exposure Level Classification

Remote Root Deterministic Information Exposure

Updated Versions

• lighttpd=conary.rpath.com@rpl:1/1.4.18-0.4-1

rPath Issue Tracking System

• RPL-2326
• RPL-2344

References

• CVE-2008-1111
• CVE-2008-1270

Description

Previous versions of the lighttpd package are vulnerable to multiple

Information Exposures, the most serious of which may allow a remote

attacker to read arbitrary files.

lighttpd is not installed by default on rPath Linux systems, and no

default configuration file is provided; only systems customized to

include and configure lighttpd are vulnerable.

Copyright 2008 rPath, Inc. This file is distributed under the terms of the MIT License. A copy is available at http://www.rpath.com/permanent/mit-license.html