Cryptographic issues in lighttpd - CVE-2013-4508

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32619

Cryptographic issues in lighttpd - CVE-2013-4508

Published: November 8, 2013 / Updated: July 28, 2020


Vulnerability identifier: #VU32619
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4508
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network. Per: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt "All versions from 1.4.24 (first version supporting SNI) up to and including 1.4.33."


Affected software

lighttpd
Gentoo Linux
Amazon Linux AMI
Fedora
lighttpd (Alpine package)
lighttpd
Adobe Commerce (formerly Magento Commerce)
Virtual Customer Access System (vCAS)

How to mitigate CVE-2013-4508

Install update from vendor's website.

lighttpd - update to 1.4.34
lighttpd (Alpine package) - update to 1.4.33-r1
lighttpd - addressed in versions 1.4.34-1.el5.1, 1.4.34-1.el6
Virtual Customer Access System (vCAS) - update to 14.10-38402

External References

Related Security Bulletins