PT-2007-5168 · Lighttpd · Lighttpd

Published 2007-07-23 · Updated 2018-10-15 · CVE-2007-3948

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: lighttpd versions 1.4.15 and prior

Description: The issue allows remote attackers to cause a denial of service or access restricted files. Errors exist in the processing of HTTP headers, mod auth, and the mechanism that limits the number of active connections. Additionally, issues are present in mod scgi, the return value of base64 decode in mod auth, and the header parsing code, which can lead to memory corruption.

Recommendations: For lighttpd versions 1.4.15 and prior, update to version 1.4.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable mod auth and mod scgi modules until a patch is available. Avoid using the base64 decode function in mod auth for basic authentication until the issue is resolved. Restrict the number of active connections to prevent denial of service attacks.

Fix

Related Identifiers

CVE-2007-3948

Affected Products

Lighttpd

References · 18

• https://security-tracker.debian.org/tracker/CVE-2007-3948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3948 · Security Note
• http://secunia.com/advisories/26158 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200708-11.xml · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_15_sr.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-3948 · Vendor Advisory
• http://debian.org/security/2008/dsa-1609 · Vendor Advisory
• http://secunia.com/advisories/26130 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3948 · Vendor Advisory
• http://securityfocus.com/archive/1/474131/100/0/threaded · Note
• http://trac.lighttpd.net/trac/changeset/1873 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3948 · Note
• http://trac.lighttpd.net/trac/ticket/1216 · Note
• http://securityfocus.com/bid/24967 · Note
• http://osvdb.org/38312 · Note