Bug 437037 (CVE-2008-1270)

Summary: CVE-2008-1270 lighttpd considers empty directory string to be CWD
Product: [Other] Security Response Reporter: Lubomir Kundrak <lkundrak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: matthias
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1270
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-03-11 20:02:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Lubomir Kundrak 2008-03-11 19:59:41 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1270 to the following vulnerability:

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

References:

http://trac.lighttpd.net/trac/ticket/1587
https://bugs.gentoo.org/show_bug.cgi?id=212930
https://issues.rpath.com/browse/RPL-2344
Comment 1 Lubomir Kundrak 2008-03-11 20:02:44 UTC 
Fedora Project does not consider this a security vulnerability.

This needs user voluntarily do a senseless and unlike configuration change with
a well-documented and expectable effect. We will not issue a security update for
this, but will follow upstream change of behavior of directive in question with
future versions.