PT-2008-5559 · Lighttpd · Lighttpd

Publicado 2008-09-27 · Atualizado 2018-10-11 · CVE-2008-4298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: lighttpd versions prior to 1.4.20

Description: A memory leak in the http request parse function in request.c allows remote attackers to cause a denial of service by consuming memory via a large number of requests with duplicate request headers.

Recommendations: For versions prior to 1.4.20, update to version 1.4.20 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-4298

DSA-1645-1

Produtos afetados

Lighttpd

Referências · 25

• https://osv.dev/vulnerability/CVE-2008-4298 · Aviso do Fabricante
• http://secunia.com/advisories/32834 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4298 · Nota de Segurança
• http://securityfocus.com/bid/31434 · Nota
• http://trac.lighttpd.net/trac/changeset/2305 · Nota
• http://debian.org/security/2008/dsa-1645 · Aviso do Fabricante
• http://secunia.com/advisories/32480 · Nota
• http://secunia.com/advisories/32972 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4298 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2741 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/497932/100/0/threaded · Nota
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45471 · Nota
• http://lighttpd.net/security/lighttpd_sa_2008_07.txt · Nota