CVE:CVE-2014-2324
CNNVD:CNNVD-201403-291
lighttpd是德国Jan Kneschke个人开发者的一款开源的Web服务器。
lighttpd 1.4.34及之前版本中的mod_evhost和mod_simple_vhost虚拟主机模块中存在路径遍历漏洞。远程攻击者可借助特制的主机名利用该漏洞读取任意文件。
solution:Upgrade lighttpd lighttpd to a higher version than 1.4.35,and avoid the version (,1.4.35); Upgrade debian debian_linux to a higher version than 6.0,7.0,8.0,and avoid the version 6.0,7.0,8.0; Upgrade opensuse opensuse to a higher version than 11.4,12.3,13.1,and avoid the version 11.4,12.3,13.1; Upgrade suse linux_enterprise_high_availability_extension to a higher version than 11:sp3,and avoid the version 11:sp3; Upgrade suse linux_enterprise_software_development_kit to a higher version than 11:sp3,and avoid the version 11:sp3; Upgrade contec sv-cpt-mc310_firmware to a higher version than 6.5,and avoid the version (,6.5)