HTTP: Lighttpd mod_fastcgi Extension CGI Variable Overwriting

This signature detects attempts to exploit a known vulnerability against Light HTTPD FastCGI . A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Extended Description

Lighttpd is prone to a remote header-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it. An attacker may exploit this issue to overwrite PHP headers such as 'SCRIPT_FILENAME'. This may allow the attacker to execute to script code, obtain sensitive information, and launch other attacks. Exploiting this issue may also aid in the remote compromise of an affected computer. Lighttpd 1.4.17 is vulnerable; prior versions may also be affected.

Affected Products

Debian linux

References

BugTraq: 25622

CVE: CVE-2007-4727

URL: http://www.milw0rm.com/exploits/4437 http://www.secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/

Short Name

HTTP:LHTTPD:FCGI-HEADER-OF

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Lighttpd mod_fastcgi Extension CGI Variable Overwriting

Extended Description

Affected Products

References

Found a potential security threat?