Lighttpd must have the latest version installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-240252	VRAU-LI-000260	SV-240252r879631_rule		High

Description
Allowing malicious users the capability to traverse server directory tree can create significant vulnerabilities. Such information and the contents of files listed should not be normally readable by the web users as they often contain information relevant to the configuration and security of the web service. Older version of Lighttpd, up to 1.4.34, have been found to be vulnerable to directory traversal and subsequent directory traversal exploits. See CVE-2014-2324 for details.

Description

Allowing malicious users the capability to traverse server directory tree can create significant vulnerabilities. Such information and the contents of files listed should not be normally readable by the web users as they often contain information relevant to the configuration and security of the web service. Older version of Lighttpd, up to 1.4.34, have been found to be vulnerable to directory traversal and subsequent directory traversal exploits. See CVE-2014-2324 for details.

STIG	Date
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide	2023-09-12

Details

Check Text ( C-43485r667931_chk )
At the command prompt, execute the following command: /opt/vmware/sbin/vami-lighttpd -v If the Lighttpd version does not have the latest version installed, this is a finding.

Fix Text (F-43444r667932_fix)
Install the latest version.