PT-2008-5559 · Lighttpd · Lighttpd

Published 2008-09-27 · Updated 2018-10-11 · CVE-2008-4298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: lighttpd versions prior to 1.4.20

Description: A memory leak in the http request parse function in request.c allows remote attackers to cause a denial of service by consuming memory via a large number of requests with duplicate request headers.

Recommendations: For versions prior to 1.4.20, update to version 1.4.20 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4298

DSA-1645-1

Affected Products

Lighttpd

References · 25

• https://osv.dev/vulnerability/CVE-2008-4298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4298 · Security Note
• http://debian.org/security/2008/dsa-1645 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4298 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-4298 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-04.xml · Vendor Advisory
• http://trac.lighttpd.net/trac/ticket/1774 · Patch
• http://secunia.com/advisories/32834 · Note
• http://securityfocus.com/bid/31434 · Note
• http://trac.lighttpd.net/trac/changeset/2305 · Note
• http://secunia.com/advisories/32480 · Note
• http://secunia.com/advisories/32972 · Note
• http://vupen.com/english/advisories/2008/2741 · Note
• http://securityfocus.com/archive/1/497932/100/0/threaded · Note