CVE-2013-0348 thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.
LowCVSS 2.1
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open source development team sthttpd | <= 2.26.4 | No fix listed |
| open source development team sthttpd | = 2.26 | No fix listed |
| open source development team sthttpd | = 2.26.1 | No fix listed |
| open source development team sthttpd | = 2.26.2 | No fix listed |
| open source development team sthttpd | = 2.26.3 | No fix listed |
| fedoraproject fedora | = 17 | No fix listed |
| fedoraproject fedora | = 18 | No fix listed |
| gentoo linux | All versions | No fix listed |
| opensuse | = 12.2 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| acme thttpd | = 2.25-b | No fix listed |
References
- openSUSE-SU-2013:1862 vendor-advisory
- openSUSE-SU-2014:0021 vendor-advisory
- opensource.dyc.edu
- [oss-security] 20130222 Re: CVE request: sthttpd world-redable logdir mailing-list
- bugs.gentoo.org patch
- bugzilla.redhat.com