Description
thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory (/) by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files.
References
- http://bugs.gentoo.org/show_bug.cgi?id=142047
- 24018 third-party-advisory
- 31965 vdb-entry
- 22349 vdb-entry
- GLSA-200701-28 vendor-advisory
- 20231127 SEC Consult SA-20231122 :: Multiple Vulnerabilities in m-privacy TightGate-Pro mailing-list
- http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html