lighttpd CVE-2013-4559 Local Privilege Escalation Vulnerability

Bugtraq ID:	63688
Class:	Design Error
CVE:	CVE-2013-4559
Remote:	No
Local:	Yes
Published:	Nov 12 2013 12:00AM
Updated:	May 07 2015 05:07PM
Credit:	clang static analyzer
Vulnerable:	lighttpd lighttpd 1.4.30 lighttpd lighttpd 1.4.26 lighttpd lighttpd 1.4.25 lighttpd lighttpd 1.4.24 lighttpd lighttpd 1.4.23 lighttpd lighttpd 1.4.20 lighttpd lighttpd 1.4.19 lighttpd lighttpd 1.4.18 lighttpd lighttpd 1.4.17 lighttpd lighttpd 1.4.16 lighttpd lighttpd 1.4.15 lighttpd lighttpd 1.4.14 lighttpd lighttpd 1.4.13 lighttpd lighttpd 1.4.12 lighttpd lighttpd 1.4.11 lighttpd lighttpd 1.4.10 lighttpd lighttpd 1.4.10a Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

lighttpd CVE-2013-4559 Local Privilege Escalation Vulnerability

lighttpd is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain elevated privileges on affected computers.

lighttpd CVE-2013-4559 Local Privilege Escalation Vulnerability

An attacker uses readily available tools to exploit the issue.

lighttpd CVE-2013-4559 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva lighttpd-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_auth-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_cml-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_compress-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_magnet-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_mysql_vhost-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_trigger_b4_dl-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lighttpd-mod_webdav-1.4.30-6.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

lighttpd CVE-2013-4559 Local Privilege Escalation Vulnerability

References:

• CVE-2013-4559 lighttpd: setuid/setgid/setgroups return value check (Red Hat Bugzilla)
  
• lighttpd Homepage (lighttpd)
  
• setuid/setgid/setgroups return values not checked (lighttpd)
  
• HPSBGN03191 rev.1 - HP Remote Device Access: Virtual Customer Access System (vCA (HP)
  
• Security update for lighttpd (Suse)