CVE:CVE-2013-4559
CNNVD:CNNVD-201311-203
lighttpd是德国Jan Kneschke个人开发者的一款开源的Web服务器。
lighttpd 1.4.32及之前的版本中存在权限许可和访问控制问题漏洞，该漏洞源于程序没有检查(1)setuid(2)setgid或(3)setgroups函数的返回值。远程攻击者可通过多次调用‘clone’函数利用该漏洞获取特权。
solution:Upgrade lighttpd lighttpd to a higher version than 1.4.33,and avoid the version (,1.4.33); Upgrade debian debian_linux to a higher version than 6.0,7.0,8.0,and avoid the version 6.0,7.0,8.0; Upgrade opensuse opensuse to a higher version than 12.2,12.3,13.1,and avoid the version 12.2,12.3,13.1