Main
Vulnerability Database
Exploits
ID:3733 - Exploit for Input validation error in lighttpd - CVE-2011-4362
ID:3733 - Exploit for Input validation error in lighttpd - CVE-2011-4362
Published: August 4, 2020
Vulnerability identifier: #VU33958
Vulnerability risk: Medium
CVE-ID: CVE-2011-4362
CWE-ID: CWE-20
Exploitation vector: Remote access
Vulnerable software:
lighttpd
lighttpd
Link to public exploit:
Vulnerability description
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
Remediation
Install update from vendor's website.