QwikSec

Security Database

CVE

CWE

Training

CVE-2013-4559

Published: Nov 19, 2013

Modified: Aug 6, 2024

PUBLISHED

Description

lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_HP

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt

x_refsource_CONFIRM

openSUSE-SU-2014:0072

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_DEBIAN

[oss-security] 20131112 Re: CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free)

mailing-list

x_refsource_MLIST

https://kc.mcafee.com/corporate/index?page=content&id=SB10310

x_refsource_CONFIRM

third-party-advisory

x_refsource_JVN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.