Multiple vulnerabilities in lighttpd



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID N/A
CWE-ID CWE-22
CWE-416
Exploitation vector Network
Public exploit N/A
Vulnerable software
 lighttpd
Server applications / Web servers

Vendor lighttpd

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU14317

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: N/A

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to insufficient check of path names under certain conditions in mod_alias (mod_alias.c). A remote attacker can submit a specially crafted URL and gain access to potentially sensitive information.


Mitigation

Update to version 1.4.50.

Vulnerable software versions

lighttpd: 1.4.1 - 1.4.49

CPE2.3 External links

https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1#diff-40a405a...
https://www.lighttpd.net/2018/8/13/1.4.50/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU14320

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: N/A

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain cause denial of service conditions.

The vulnerability exists due to use-after-free error when processing data passed via Range HTTP header. A remote unauthenticated attacker can send a specially crafted HTTP request to the affected server, trigger use-after-free error and crash the affected web server. 


Mitigation

Update to version 1.4.50.

Vulnerable software versions

lighttpd: 1.4.1 - 1.4.49

CPE2.3 External links

https://github.com/lighttpd/lighttpd1.4/commit/d161f53de04bc826ce1bdaeb3dce2c72ca50a3f8 
https://www.lighttpd.net/2018/8/13/1.4.50/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###