PT-2011-4943 · Lighttpd+1 · Lighttpd+1

Jan Lieskovsky · Published 2011-12-24 · Updated 2024-06-15 · CVE-2011-4362

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions lighttpd versions 1.4 before 1.4.30 lighttpd versions 1.5 before SVN revision 2806

Description The issue is caused by an integer signedness error in the base64 decode function within the HTTP authentication functionality. This error allows remote attackers to trigger a denial of service, resulting in a segmentation fault, by providing crafted base64 input that causes an out-of-bounds read with a negative index.

Recommendations For lighttpd versions 1.4 before 1.4.30, update to version 1.4.30 or later. For lighttpd versions 1.5 before SVN revision 2806, update to SVN revision 2806 or later.

Exploit

Fix

Related Identifiers

CVE-2011-4362

DSA-2368-1

OPENSUSE-SU-2024:10402-1

SUSE-SU-2012_0201-1

SUSE-SU-2012_0201-2

Affected Products

Lighttpd

Suse

References · 39

• 🔥 http://exploit-db.com/exploits/18295 · Exploit
• 🔥 http://blog.pi3.com.pl/?p=277 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/11/29/13 · Exploit
• 🔥 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt · Exploit
• 🔥 http://redmine.lighttpd.net/issues/2370 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/11/29/8 · Exploit
• 🔥 https://exploit-db.com/exploits/18295 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2011-4362 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10402-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4362 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4362 · Security Note
• http://debian.org/security/2011/dsa-2368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4362 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4362 · Vendor Advisory
• https://suse.com/security/cve/CVE-2013-4560 · Note