CVE-2013-1427 in lighttpd
Summary
The configuration file for the FastCGI PHP support for lighthttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Reservation
01/26/2013
Disclosure
03/21/2013
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 8036 | lighttpd Configuration File Temporary Files cryptographic issue | 310 | High | Official fix | CVE-2013-1427 |