PT-2015-6091 · Lighttpd+3 · Lighttpd+3

Publicado 2015-05-25 · Atualizado 2021-03-15 · CVE-2015-3200

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions lighttpd versions prior to 1.4.36

Description The issue allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character. This can be achieved by using a string containing a NULL and new line character in the authentication string.

Recommendations For versions prior to 1.4.36, update to version 1.4.36 or later to resolve the issue.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

ALT-PU-2015-1640

BDU:2025-16007

CVE-2015-3200

MGASA-2015-0338

SUSE-SU-2017:0728-1

SUSE-SU-2017:0731-1

SUSE-SU-2017_0728-1

SUSE-SU-2017_0731-1

USN-4775-1

Produtos afetados

Alt Linux

Lighttpd

Suse

Ubuntu

Referências · 50

• 🔥 http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.html · Exploit
• https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1 · Nota
• https://bugzilla.suse.com/932286 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://bugs.mageia.org/show_bug.cgi?id=16555 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3200 · Nota de Segurança
• http://redmine.lighttpd.net/issues/2646 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2017/suse-su-20170731-1 · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10310 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.html · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2015-1640 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-3200.html · Nota
• https://ubuntu.com/security/CVE-2018-19052 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0338 · Aviso do Fabricante
• https://redmine.lighttpd.net/issues/2646 · Nota