Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

Bugtraq ID:	31600
Class:	Access Validation Error
CVE:	CVE-2008-4360
Remote:	Yes
Local:	No
Published:	Oct 06 2008 12:00AM
Updated:	Apr 13 2015 09:32PM
Credit:	Reported by the vendor
Vulnerable:	SuSE SUSE Linux Enterprise 11 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 rPath rPath Linux 2 rPath rPath Linux 1 lighttpd lighttpd 1.4.18 lighttpd lighttpd 1.4.17 lighttpd lighttpd 1.4.16 lighttpd lighttpd 1.4.15 lighttpd lighttpd 1.4.14 lighttpd lighttpd 1.4.13 lighttpd lighttpd 1.4.12 lighttpd lighttpd 1.4.11 lighttpd lighttpd 1.4.10 lighttpd lighttpd 1.4.9 lighttpd lighttpd 1.4.8 lighttpd lighttpd 1.4.7 lighttpd lighttpd 1.4.6 lighttpd lighttpd 1.4.5 lighttpd lighttpd 1.4.4 lighttpd lighttpd 1.4.3 lighttpd lighttpd 1.4.2 lighttpd lighttpd 1.4.1 lighttpd lighttpd 1.4 lighttpd lighttpd 1.4.10a Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	lighttpd lighttpd 1.4.20

Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

The 'lighttpd' program is prone to a security-bypass vulnerability that occurs in the 'mod_userdir' module.

Attackers can exploit this issue to bypass certain security restrictions and obtain sensitive information. This may lead to other attacks.

Versions prior to 'lighttpd' 1.4.20 are vulnerable.

Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

Solution:
The vendor has released lighttpd 1.4.20 to address this issue. Please see the references for more information.


Debian Linux 4.0 arm

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_arm.deb


• Debian lighttpd_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_arm.deb

Debian Linux 4.0 powerpc

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_powerpc.deb


• Debian lighttpd_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_powerpc.deb

Debian Linux 4.0 m68k

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 amd64

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_amd64.deb


• Debian lighttpd_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_amd64.deb

Debian Linux 4.0 ia-32

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_i386.deb


• Debian lighttpd_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_i386.deb

Debian Linux 4.0 hppa

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_hppa.deb


• Debian lighttpd_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_hppa.deb

Debian Linux 4.0 sparc

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_sparc.deb


• Debian lighttpd_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_sparc.deb

Debian Linux 4.0 s/390

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch3_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch3_s390.deb


• Debian lighttpd_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_s390.deb

Debian Linux 4.0 alpha

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 mipsel

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 ia-64

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_ia64.deb


• Debian lighttpd_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_ia64.deb

lighttpd lighttpd 1.4.10a

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

Debian Linux 4.0 mips

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_mips.deb


• Debian lighttpd_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_mips.deb

lighttpd lighttpd 1.4.1

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.10

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.11

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.12

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.13

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.14

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.15

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.16

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.17

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.18

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.2

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.3

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.4

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.5

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.6

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.7

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.8

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

lighttpd lighttpd 1.4.9

• lighttpd lighttpd-1.4.20.tar.gz
  http://www.lighttpd.net/download/lighttpd-1.4.20.tar.gz

Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability

References:

• lighttpd Home Page (lighttpd)
  
• mod_userdir information disclosure (lighttpd)