PT-2011-4943 · Lighttpd+1 · Lighttpd+1

Jan Lieskovsky · Publicado 2011-12-24 · Atualizado 2024-06-15 · CVE-2011-4362

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions lighttpd versions 1.4 before 1.4.30 lighttpd versions 1.5 before SVN revision 2806

Description The issue is caused by an integer signedness error in the base64 decode function within the HTTP authentication functionality. This error allows remote attackers to trigger a denial of service, resulting in a segmentation fault, by providing crafted base64 input that causes an out-of-bounds read with a negative index.

Recommendations For lighttpd versions 1.4 before 1.4.30, update to version 1.4.30 or later. For lighttpd versions 1.5 before SVN revision 2806, update to SVN revision 2806 or later.

Exploit

Correção

Identificadores relacionados

CVE-2011-4362

DSA-2368-1

OPENSUSE-SU-2024:10402-1

SUSE-SU-2012_0201-1

SUSE-SU-2012_0201-2

Produtos afetados

Lighttpd

Suse

Referências · 39

• 🔥 http://exploit-db.com/exploits/18295 · Exploit
• 🔥 http://blog.pi3.com.pl/?p=277 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/11/29/13 · Exploit
• 🔥 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt · Exploit
• 🔥 http://redmine.lighttpd.net/issues/2370 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/11/29/8 · Exploit
• 🔥 https://exploit-db.com/exploits/18295 · Exploit
• https://suse.com/security/cve/CVE-2013-4560 · Nota
• https://suse.com/security/cve/CVE-2013-4508 · Nota
• https://suse.com/security/cve/CVE-2014-2323 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=758624 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-4362 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/71536 · Nota
• https://suse.com/security/cve/CVE-2013-4559 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2012-February/000022.html · Nota