#VU32619 Cryptographic issues in lighttpd - CVE-2013-4508
Published: November 8, 2013 / Updated: July 28, 2020
Vulnerability identifier: #VU32619
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2013-4508
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
lighttpd
lighttpd
Software vendor:
lighttpd
lighttpd
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network. Per: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt "All versions from 1.4.24 (first version supporting SNI) up to and including 1.4.33."
Remediation
Install update from vendor's website.
External links
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
- http://marc.info/?l=bugtraq&m=141576815022399&w=2
- http://openwall.com/lists/oss-security/2013/11/04/19
- http://redmine.lighttpd.net/issues/2525
- http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/
- https://www.debian.org/security/2013/dsa-2795