バナーによると、リモートホストで実行されているlighttpdのバージョンは、1.4.19より前です。したがって、次の脆弱性の影響を受ける可能性があります。- lighttpdはファイル記述子配列のサイズを不適切に計算しているため、リモートの攻撃者が多数の接続を介して、領域外読み取りエラーの原因となるサービス拒否（クラッシュ）を引き起こす可能性があります。- lighttpdはフォークに失敗したときに500エラーの代わりにCGIスクリプトのソースコードを送信するため、リモートの攻撃者が秘密情報を取得する可能性があります。- userdir.pathが設定されていないとき、デフォルトの$HOMEが使用され、リモートの攻撃者が任意のファイルを読み取る可能性があります。Nessusはこれらの問題をテストしていませんが、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

根據其標題，遠端主機上執行的 lighttpd 版本比 1.4.19 舊。因此可能受到下列多個弱點影響：- lighttpd 未正確計算檔案描述元陣列的大小，遠端攻擊者可藉以透過大量連線觸發超出邊界存取，進而造成拒絕服務 (損毀)。- 發生分支錯誤時，lighttpd 會傳送 CGI 指令碼的原始程式碼，而非 500 錯誤，遠端攻擊者可藉以取得敏感資訊。- 若在未設定 userdir.path 的情況下使用 $HOME 預設值，遠端攻擊者可能可藉以讀取任意檔案。請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

Julien Cayzac discovered that under certain circumstances lighttpd, a fast webserver with minimal memory footprint, might allow the reading of arbitrary files from the system. This problem could only occur with a non-standard configuration.

根据其标题，远程主机上运行的 lighttpd 版本低于 1.4.19。因而可能会受到下列漏洞的影响：- lighttpd 未正确计算文件描述符数组的大小，允许远程攻击者通过大量连接触发越界访问，导致拒绝服务（崩溃）。- 发生分支错误时，lighttpd 发送 CGI 脚本的源代码，而非 500 错误，可能允许远程攻击者获得敏感信息。- 未设置 userdir.path 时使用默认 $HOME，可能允许远程攻击者读取任意文件。请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.19. Therefore, it may be, affected by the following vulnerabilities :

  - lighttpd does not properly calculate the size of a file descriptor     array, which allows remote attackers to cause a denial of service     (crash) via a large number of connections, which triggers an     out-of-bounds access.

  - lighttpd sends the source code of CGI scripts instead of a 500     error when a fork failure occurs, which might allow remote     attackers to obtain sensitive information.

  - When userdir.path is not set, uses a default of $HOME, which     might allow remote attackers to read arbitrary files.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Remote attackers were able to crash lighttpd by opening     a large number of connections (CVE-2008-0983).

  - A bug in mod_cgi allowed remote attackers to read cgi     source files (CVE-2008-1111).

  - A bug in mod_userdir allowed remote attackers to read     arbitrary files (CVE-2008-1270).

The remote host is affected by the vulnerability described in GLSA-200804-08 (lighttpd: Multiple vulnerabilities)

    Julien Cayzax discovered that an insecure default setting exists in     mod_userdir in lighttpd. When userdir.path is not set the default value     used is $HOME. It should be noted that the 'nobody' user's $HOME is '/'     (CVE-2008-1270). An error also exists in the SSL connection code which     can be triggered when a user prematurely terminates his connection     (CVE-2008-1531).
  Impact :

    A remote attacker could exploit the first vulnerability to read     arbitrary files. The second vulnerability can be exploited by a remote     attacker to cause a Denial of Service by terminating a victim's SSL     connection.
  Workaround :

    As a workaround for CVE-2008-1270 you can set userdir.path to a     sensible value, e.g. 'public_html'.

The remote host is running Lighttpd, a small web server.  This version of Lighttpd is vulnerable to an information disclosure flaw.  The 'mod_cgi' module, when put under a considerable load, could fail to fork its process.  Such a failure would lead to the web server returning the source code of the CGI script that had been requested.  An attacker exploiting this flaw would be able to gain access to potentially confidential data.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
106624	lighttpd < 1.4.19の複数の脆弱性	Nessus	Web Servers	2018/2/6	2018/2/7	medium
106624	lighttpd < 1.4.19 多個弱點	Nessus	Web Servers	2018/2/6	2018/2/7	medium
31592	Debian DSA-1521-1 : lighttpd - file disclosure	Nessus	Debian Local Security Checks	2008/3/17	2021/1/4	medium
106624	lighttpd < 1.4.19 多个漏洞	Nessus	Web Servers	2018/2/6	2018/2/7	medium
106624	lighttpd < 1.4.19 Multiple Vulnerabilities	Nessus	Web Servers	2018/2/6	2018/2/7	medium
31775	openSUSE 10 Security Update : lighttpd (lighttpd-5107)	Nessus	SuSE Local Security Checks	2008/4/4	2021/1/14	medium
31955	GLSA-200804-08 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2008/4/17	2021/1/6	medium
4411	Lighttpd < 1.4.19 Information Disclosure	Nessus Network Monitor	Web Servers	2008/3/5	2019/3/6	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium