Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title lighttpd: Multiple vulnerabilities
Informations
Name GLSA-201406-10 First vendor Publication 2014-06-13
Vendor Gentoo Last vendor Modification 2014-06-13
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.6 Attack Range Network
Cvss Impact Score 10 Attack Complexity High
Cvss Expoit Score 4.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities have been found in lighttpd, allowing remote attackers cause a Denial of Service condition or execute arbitrary SQL statements.

Background

lighttpd is a lightweight high-performance web server.

Description

Multiple vulnerabilities have been discovered in lighttpd. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could create a Denial of Service condition.
Futhermore, a remote attacker may be able to execute arbitrary SQL statements.

Workaround

There is no known workaround at this time.

Resolution

All lighttpd users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.35"

References

[ 1 ] CVE-2011-4362 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4362
[ 2 ] CVE-2012-5533 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5533
[ 3 ] CVE-2013-4508 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4508
[ 4 ] CVE-2013-4559 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4559
[ 5 ] CVE-2013-4560 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4560
[ 6 ] CVE-2014-2323 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2323

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-10.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201406-10.xml

CWE : Common Weakness Enumeration

% Id Name
20 % CWE-416 Use After Free
20 % CWE-399 Resource Management Errors
20 % CWE-326 Inadequate Encryption Strength
20 % CWE-264 Permissions, Privileges, and Access Controls
20 % CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20141
 
Oval ID: oval:org.mitre.oval:def:20141
Title: DSA-2795-1 lighttpd - several
Description: Several vulnerabilities have been discovered in the lighttpd web server.
Family: unix Class: patch
Reference(s): DSA-2795-1
CVE-2013-4508
CVE-2013-4559
CVE-2013-4560
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
 Product(s): lighttpd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28476
 
Oval ID: oval:org.mitre.oval:def:28476
Title: DSA-2795-2 -- lighttpd -- several vulnerabilities
Description: Several vulnerabilities have been discovered in the lighttpd web server.
Family: unix Class: patch
Reference(s): DSA-2795-2
CVE-2013-4508
CVE-2013-4559
CVE-2013-4560
 Version: 3
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): lighttpd
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 70
Os 4
Os 4
Os 1
Os 1

ExploitDB Exploits

id Description
2012-11-22 lighttpd 1.4.31 Denial of Service PoC
2011-12-31 lighttpd Denial of Service Vulnerability PoC

OpenVAS Exploits

Date Description
2012-11-26 Name : FreeBSD Ports: lighttpd
File : nvt/freebsd_lighttpd8.nasl
2012-11-23 Name : Lighttpd Connection header Denial of Service Vulnerability
File : nvt/gb_lighttpd_connection_hdr_dos_vuln.nasl
2012-08-30 Name : Fedora Update for lighttpd FEDORA-2012-9040
File : nvt/gb_fedora_2012_9040_lighttpd_fc17.nasl
2012-06-28 Name : Fedora Update for lighttpd FEDORA-2012-9078
File : nvt/gb_fedora_2012_9078_lighttpd_fc16.nasl
2012-02-11 Name : Debian Security Advisory DSA 2368-1 (lighttpd)
File : nvt/deb_2368_1.nasl
0000-00-00 Name : FreeBSD Ports: lighttpd
File : nvt/freebsd_lighttpd7.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
77366 lighttpd src/http_auth.c base64_decode() Function Base64 Data Parsing Out-of-...

Snort® IPS/IDS

Date Description
2014-01-10 lighthttpd connection header denial of service attempt
RuleID : 24805 - Revision : 3 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_lighttpd_20140715.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_lighttpd_20120417.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-346.nasl - Type : ACT_GATHER_INFO
2014-06-16 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-10.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_4_lighttpd-120130.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-43.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-257.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-801.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-110.nasl - Type : ACT_GATHER_INFO
2014-03-26 Name : The remote Fedora host is missing a security update.
File : fedora_2014-3947.nasl - Type : ACT_GATHER_INFO
2014-03-26 Name : The remote Fedora host is missing a security update.
File : fedora_2014-3887.nasl - Type : ACT_GATHER_INFO
2014-03-20 Name : The remote web server is affected by multiple vulnerabilities.
File : lighttpd_1_4_35.nasl - Type : ACT_GATHER_INFO
2014-03-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2877.nasl - Type : ACT_GATHER_INFO
2014-03-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-299.nasl - Type : ACT_GATHER_INFO
2014-03-05 Name : The remote web server is affected by multiple vulnerabilities.
File : lighttpd_1_4_34.nasl - Type : ACT_GATHER_INFO
2014-02-24 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2506.nasl - Type : ACT_GATHER_INFO
2014-02-24 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2495.nasl - Type : ACT_GATHER_INFO
2014-02-14 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_90b27045953011e39d09000c2980a9f3.nasl - Type : ACT_GATHER_INFO
2013-11-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-277.nasl - Type : ACT_GATHER_INFO
2013-11-21 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2795.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-107.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Fedora host is missing a security update.
File : fedora_2013-15345.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Fedora host is missing a security update.
File : fedora_2013-15344.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-179.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-100.nasl - Type : ACT_GATHER_INFO
2012-11-29 Name : The remote web server is affected by a denial of service vulnerability.
File : lighttpd_1_4_32.nasl - Type : ACT_GATHER_INFO
2012-11-23 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_1cd3ca4233e611e2a2555404a67eef98.nasl - Type : ACT_GATHER_INFO
2012-06-26 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9078.nasl - Type : ACT_GATHER_INFO
2012-06-26 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9040.nasl - Type : ACT_GATHER_INFO
2012-01-12 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2368.nasl - Type : ACT_GATHER_INFO
2011-12-29 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_c6521b04314b11e19cf45404a67eef98.nasl - Type : ACT_GATHER_INFO
2011-12-28 Name : The remote web server is affected by a denial of service vulnerability.
File : lighttpd_1_4_30.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-06-17 13:25:41
  • Multiple Updates
2014-06-14 00:20:59
  • First insertion