Integer overflow in lighttpd

Published: 2019-04-23 23:45:13 | Updated: 2019-04-24
Severity Medium
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2019-11072
CVSSv3 6.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]
CWE ID CWE-190
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software lighttpd
Vulnerable software versions lighttpd 1.4.1
lighttpd 1.4.2
lighttpd 1.4.3

Show more

Vendor URL lighttpd

Security Advisory

1) Integer overflow

Description

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to signed integer overflow when processing "/%2F?" characters in burl_normalize_2F_to_slash_fix() function in burl.c, when url-path-2f-decode option is enabled. A remote attacker can send a specially crafted HTTP GET request to the affected server, trigger integer overflow and crash the service.

Remediation

Install updates from vendor's repository.

External links

http://www.securityfocus.com/bid/107907
https://github.com/lighttpd/lighttpd1.4/commit/32120d5b8b3203fc21ccb9eafb0eaf824bb59354
https://redmine.lighttpd.net/issues/2945

Back to List