Lighttpd must have the latest version installed.

From VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide

Associated with: CCI-001082

SV-99935r1_rule Lighttpd must have the latest version installed.

Vulnerability discussion

Allowing malicious users the capability to traverse server directory tree can create significant vulnerabilities. Such information and the contents of files listed should not be normally readable by the web users as they often contain information relevant to the configuration and security of the web service.Older version of Lighttpd, up to 1.4.34, have been found to be vulnerable to directory traversal and subsequent directory traversal exploits. See CVE-2014-2324 for details.

Check content

At the command prompt, execute the following command: /opt/vmware/sbin/vami-lighttpd -v If the Lighttpd version does not have the latest version installed, this is a finding.

Fix text

Install the latest version.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.