Description
The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.
References
- GLSA-200502-21 vendor-advisory
- 14297 third-party-advisory
- http://article.gmane.org/gmane.comp.web.lighttpd/1171