SB2007041802 - Input validation error in lighttpd
Published: April 18, 2007 Updated: August 4, 2020
Security Bulletin ID
SB2007041802
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2007-1869)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.
Remediation
Install update from vendor's website.
References
- http://secunia.com/advisories/24886
- http://secunia.com/advisories/24947
- http://secunia.com/advisories/24995
- http://secunia.com/advisories/25166
- http://secunia.com/advisories/25613
- http://security.gentoo.org/glsa/glsa-200705-07.xml
- http://www.debian.org/security/2007/dsa-1303
- http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt
- http://www.novell.com/linux/security/advisories/2007_007_suse.html
- http://www.securityfocus.com/archive/1/466464/30/6900/threaded
- http://www.securityfocus.com/bid/23515
- http://www.vupen.com/english/advisories/2007/1399
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33671
- https://issues.rpath.com/browse/RPL-1218