| Main Archive Page > Month Archives > full-disclosure-uk archives |
[Full-disclosure] [ GLSA 200708-11 ] Lighttpd: Multiple vulnerabilities
From: Raphael Marichez <falco_at_nospam>Date: Thu Aug 16 2007 - 19:44:13 GMT
To: gentoo-announce@gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200708-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
Several vulnerabilities were reported in Lighttpd, most of them allowing a Denial of Service and potentially the remote execution of arbitrary code.
Background
Lighttpd is a lightweight HTTP web server.
Affected packages
Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/lighttpd < 1.4.16 >= 1.4.16
Description
Stefan Esser discovered errors with evidence of memory corruption in the code parsing the headers. Several independent researchers also reported errors involving the handling of HTTP headers, the mod_auth and mod_scgi modules, and the limitation of active connections.
Impact
A remote attacker can trigger any of these vulnerabilities by sending malicious data to the server, which may lead to a crash or memory exhaustion, and potentially the execution of arbitrary code. Additionally, access-deny settings can be evaded by appending a final / to a URL.
Workaround
There is no known workaround at this time.
Resolution
All Lighttpd users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.16"
References
[ 1 ] CVE-2007-3946
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3946
[ 2 ] CVE-2007-3947
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3947
[ 3 ] CVE-2007-3948
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3948
[ 4 ] CVE-2007-3949
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3949
[ 5 ] CVE-2007-3950
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3950
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200708-11.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/