CVE-2007-3949

Published: 24 July 2007

mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.

Priority

Package	Release	Status
lighttpd Launchpad, Ubuntu, Debian	dapper	Released (1.4.11-3ubuntu3.5)
	edgy	Released (1.4.13~r1370-1ubuntu1.3)
	feisty	Released (1.4.13-9ubuntu4.2)
	gutsy	Not vulnerable
	upstream	Released (1.4.16)

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.