PT-2013-5048 · Lighttpd+1 · Lighttpd+1

Published 2013-11-08 · Updated 2024-06-15 · CVE-2013-4508

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions lighttpd versions 1.4.24 through 1.4.33

Description The issue allows remote attackers to hijack sessions or obtain sensitive information by exploiting weak SSL ciphers when SNI is enabled. This can be achieved by inserting packets into the client-server data stream or sniffing the network.

Recommendations For lighttpd versions 1.4.24 through 1.4.33, update to version 1.4.34 or later to resolve the issue.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

ALT-PU-2014-1074

CVE-2013-4508

DSA-2795-1

MGASA-2013-0334

OPENSUSE-SU-2024:10402-1

Affected Products

Alt Linux

Lighttpd

References · 36

• 🔥 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt · Exploit
• https://security-tracker.debian.org/tracker/CVE-2013-4508 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4508 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4508 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0334 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4508 · Security Note
• http://redmine.lighttpd.net/issues/2525 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4508 · Vendor Advisory
• https://debian.org/security/2013/dsa-2795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4508 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10402-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=141576815022399&w=2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4508 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4508 · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html · Vendor Advisory