Stack-based buffer overflow in lighttpd - CVE-2014-1878

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the cmd_submitf function in cgi/cmd.c when processing a long message to cmd.cgi. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2014-1878

External References

• http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html
• http://secunia.com/advisories/57024
• http://www.securityfocus.com/bid/65605
• https://bugzilla.redhat.com/show_bug.cgi?id=1066578
• https://dev.icinga.org/issues/5434
• https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html
• https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6

Related Security Bulletins

• Stack-based buffer overflow in Nagios
• Stack-based buffer overflow in nagios (Alpine package)