CVE-2013-1427
EUVD-2013-146521.03.2013, 17:55
The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| lighttpd | lighttpd | 𝑥 ≤ 1.4.27 |
| lighttpd | lighttpd | 1.3.16 |
| lighttpd | lighttpd | 1.4.3 |
| lighttpd | lighttpd | 1.4.4 |
| lighttpd | lighttpd | 1.4.5 |
| lighttpd | lighttpd | 1.4.6 |
| lighttpd | lighttpd | 1.4.7 |
| lighttpd | lighttpd | 1.4.8 |
| lighttpd | lighttpd | 1.4.9 |
| lighttpd | lighttpd | 1.4.10 |
| lighttpd | lighttpd | 1.4.11 |
| lighttpd | lighttpd | 1.4.12 |
| lighttpd | lighttpd | 1.4.13 |
| lighttpd | lighttpd | 1.4.15 |
| lighttpd | lighttpd | 1.4.16 |
| lighttpd | lighttpd | 1.4.18 |
| lighttpd | lighttpd | 1.4.19 |
| lighttpd | lighttpd | 1.4.20 |
| lighttpd | lighttpd | 1.4.21 |
| lighttpd | lighttpd | 1.4.22 |
| lighttpd | lighttpd | 1.4.23 |
| lighttpd | lighttpd | 1.4.24 |
| lighttpd | lighttpd | 1.4.25 |
| lighttpd | lighttpd | 1.4.26 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References