Input validation error in lighttpd - CVE-2012-5533
Published: November 24, 2012 / Updated: July 29, 2020
Vulnerability identifier: #VU32618
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-5533
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header.
Affected software
lighttpd
Gentoo Linux
Amazon Linux AMI
Fedora
lighttpd (Alpine package)
lighttpd
Adobe Commerce (formerly Magento Commerce)
Virtual Customer Access System (vCAS)
Gentoo Linux
Amazon Linux AMI
Fedora
lighttpd (Alpine package)
lighttpd
Adobe Commerce (formerly Magento Commerce)
Virtual Customer Access System (vCAS)
How to mitigate CVE-2012-5533
The vendor has issued the following versions to address this vulnerability: 1.4.31, 1.4.32.
lighttpd - addressed in versions 1.4.31, 1.4.32
lighttpd (Alpine package) - update to 1.4.33-r0
lighttpd - addressed in versions 1.4.32-1.el5, 1.4.32-1.el6
Virtual Customer Access System (vCAS) - update to 14.10-38402
lighttpd (Alpine package) - update to 1.4.33-r0
lighttpd - addressed in versions 1.4.32-1.el5, 1.4.32-1.el6
Virtual Customer Access System (vCAS) - update to 14.10-38402
Links to Public Exploits and PoC-codes
External References
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2012_01.txt
- http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.31_fix_connection_header_dos.patch
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00044.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00051.html
- http://marc.info/?l=bugtraq&m=141576815022399&w=2
- http://osvdb.org/87623
- http://packetstormsecurity.org/files/118282/Simple-Lighttpd-1.4.31-Denial-Of-Service.html
- http://secunia.com/advisories/51268
- http://secunia.com/advisories/51298
- http://www.exploit-db.com/exploits/22902
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:100
- http://www.openwall.com/lists/oss-security/2012/11/21/1
- http://www.securityfocus.com/bid/56619
- http://www.securitytracker.com/id?1027802
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80213
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0345
Related Security Bulletins
- Input validation error in lighttpd
- Input validation error in lighttpd (Alpine package)
- Amazon Linux AMI update for lighttpd
- Gentoo update for lighttpd
- Multiple vulnerabilities in HP Remote Device Access: Virtual Customer Access System (vCAS)
- Fedora EPEL 6 update for lighttpd
- Fedora EPEL 5 update for lighttpd