CVEvulnerability
CVE-2013-4559
7.6 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-11-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.
Affected configurations
• lighttpd lighttpd (< 1.4.33)
• debian debian linux 6.0
• debian debian linux 7.0
• debian debian linux 8.0
• opensuse opensuse 12.2
• opensuse opensuse 12.3
• opensuse opensuse 13.1
Related
Weakness · not in database (1)
References
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt Vendor Advisory
- http://jvn.jp/en/jp/JVN37417423/index.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=141576815022399&w=2 Issue Tracking, Third Party Advisory
- http://secunia.com/advisories/55682 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/11/12/4 Mailing List, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10310 Third Party Advisory
- https://www.debian.org/security/2013/dsa-2795 Third Party Advisory
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt Vendor Advisory
- http://jvn.jp/en/jp/JVN37417423/index.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=141576815022399&w=2 Issue Tracking, Third Party Advisory
- http://secunia.com/advisories/55682 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/11/12/4 Mailing List, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10310 Third Party Advisory
- https://www.debian.org/security/2013/dsa-2795 Third Party Advisory