CVE-2013-4559

lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

CVSS v2.0 7.6 HIGH

7.6^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt	Vendor Advisory
http://jvn.jp/en/jp/JVN37417423/index.html	Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html	Mailing List Third Party Advisory
http://marc.info/?l=bugtraq&m=141576815022399&w=2	Issue Tracking Third Party Advisory
http://secunia.com/advisories/55682	Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/11/12/4	Mailing List Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10310	Third Party Advisory
https://www.debian.org/security/2013/dsa-2795	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:6.0:::::::*
	cpe:2.3:o:debian:debian_linux:7.0:::::::*
	cpe:2.3:o:debian:debian_linux:8.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:opensuse:opensuse:12.2:::::::*
	cpe:2.3:o:opensuse:opensuse:12.3:::::::*
	cpe:2.3:o:opensuse:opensuse:13.1:::::::*

History

No history.

Information

Published : 2013-11-20 14:12

Updated : 2024-02-04 18:16

NVD link : CVE-2013-4559

Mitre link : CVE-2013-4559

CVE.ORG link : CVE-2013-4559

JSON object : View

Products Affected

debian

debian_linux

lighttpd

lighttpd

opensuse

opensuse

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-4559", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-11-20T14:12:30.727", "references": [{"url": "http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://jvn.jp/en/jp/JVN37417423/index.html", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://marc.info/?l=bugtraq&m=141576815022399&w=2", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/55682", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2013/11/12/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10310", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://www.debian.org/security/2013/dsa-2795", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached."}, {"lang": "es", "value": "lighttpd anterior a la versi\u00f3n 1.4.33 no comprueba el valor de vuelta de (1) setuid, (2) setgid, o (3) setgroups, lo que podr\u00eda causar que lighttpd se ejecute bajo administrador si es reiniciado y permitir a atacantes remotos obtener privilegios, tal y como se demostr\u00f3 con m\u00faltiples llamadas a la funci\u00f3n de clonado que provoc\u00f3 que setuid fallara cuando el l\u00edmite de proceso de usuario era alcanzado."}], "lastModified": "2021-02-26T15:14:05.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "855B05A3-31E9-4323-9BD0-CA7DF99FDD97", "versionEndExcluding": "1.4.33"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "036E8A89-7A16-411F-9D31-676313BB7244"}, {"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D806A17E-B8F9-466D-807D-3F1E77603DC8"}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668"}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}