CVE-2013-4559

Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 19 Nov 2013, 19:00
Last modified:06 Aug 2024, 16:45

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
7.6 HIGH
v2.0 (nvd)
EPSS Score
9.52% LOW
10% probability -4.46%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Nov 2013, 19:00
Published
Vulnerability first disclosed
06 Aug 2024, 16:45
Last Modified
Vulnerability information updated

Description

lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

CVSS Metrics

  • v2.0•HIGH•Score: 7.6AV:N/AC:H/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 9.52%• Percentile: 93%

Techniques & Countermeasures

  • CWE-264•Permissions, Privileges, and Access Controls

    Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

  • debian•debian_linux

    6.0 | 7.0 | 8.0

  • lighttpd•lighttpd

    < 1.4.33

  • opensuse•opensuse

    12.2 | 12.3 | 13.1

References (8)