CVE:CVE-2013-0348
CNNVD:CNNVD-201302-551
thttpd是ACME实验室的一款轻量级的HTTP服务器，它支持基于URL的文件流量限制，以及支持多种平台，如FreeBSD、SunOS、Solaris、BSD等。sthttpd是thttpd的改进版，包含了一个嵌入功能，能够开发嵌入式系统的Web服务器。
sthttpd 2.26.4及之前的版本和thttpd 2.25b版本中的thttpd.c文件中存在安全漏洞，该漏洞源于程序对/var/log/thttpd.log日志文件设置为全局可读权限。本地攻击者可通过读取文件利用该漏洞获取敏感信息。
solution:Upgrade open_source_development_team sthttpd to a higher version than 2.26.4,2.26,2.26.1,2.26.2,2.26.3,and avoid the version (,2.26.4],2.26,2.26.1,2.26.2,2.26.3; Upgrade fedoraproject fedora to a higher version than 17,18,and avoid the version 17,18; Upgrade gentoo linux to a higher version than *; Upgrade opensuse opensuse to a higher version than 12.2,12.3,13.1,and avoid the version 12.2,12.3,13.1; Upgrade acme thttpd to a higher version than 2.25:b,and avoid the version 2.25:b