Vulnerability identifier: #VU32410
Vulnerability risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-476
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
lighttpd
Server applications /
Web servers
Vendor: lighttpd
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a request to a file whose mtime is 0, which results in a NULL pointer dereference.
Mitigation
Update to version 1.4.14.
Vulnerable software versions
lighttpd: 1.4.1 - 1.4.13
External links
http://secunia.com/advisories/24886
http://secunia.com/advisories/24947
http://secunia.com/advisories/24995
http://secunia.com/advisories/25166
http://secunia.com/advisories/25613
http://security.gentoo.org/glsa/glsa-200705-07.xml
http://www.debian.org/security/2007/dsa-1303
http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt
http://www.novell.com/linux/security/advisories/2007_007_suse.html
http://www.securityfocus.com/archive/1/466464/30/6900/threaded
http://www.securityfocus.com/bid/23515
http://www.vupen.com/english/advisories/2007/1399
http://exchange.xforce.ibmcloud.com/vulnerabilities/33678
http://issues.rpath.com/browse/RPL-1218
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.