UCF STIG Viewer Logo

Lighttpd must have the latest version installed.


Overview

Finding ID Version Rule ID IA Controls Severity
V-89285 VRAU-LI-000260 SV-99935r1_rule High
Description
Allowing malicious users the capability to traverse server directory tree can create significant vulnerabilities. Such information and the contents of files listed should not be normally readable by the web users as they often contain information relevant to the configuration and security of the web service. Older version of Lighttpd, up to 1.4.34, have been found to be vulnerable to directory traversal and subsequent directory traversal exploits. See CVE-2014-2324 for details.
STIG Date
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide 2018-10-12

Details

Check Text ( C-88977r2_chk )
At the command prompt, execute the following command:

/opt/vmware/sbin/vami-lighttpd -v

If the Lighttpd version does not have the latest version installed, this is a finding.
Fix Text (F-96027r1_fix)
Install the latest version.