lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.

Two remotely exploitable DoS vulnerabilities in lighttpd can be used to crash lighttpd or make it waste CPU time in an enless loop (CVE-2007-1869, CVE-2007-1870).

Two problems were discovered with lighttpd, a fast webserver with minimal memory footprint, which could allow denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1869     Remote attackers could cause denial of service by     disconnecting partway through making a request.

  - CVE-2007-1870     A NULL pointer dereference could cause a crash when     serving files with a mtime of 0.

The remote host is affected by the vulnerability described in GLSA-200705-07 (Lighttpd: Two Denials of Service)

    Robert Jakabosky discovered an infinite loop triggered by a connection     abort when Lighttpd processes carriage return and line feed sequences.
    Marcus Rueckert discovered a NULL pointer dereference when a server     running Lighttpd tries to access a file with a mtime of 0.
  Impact :

    A remote attacker could upload a specially crafted file to the server     or send a specially crafted request and then abort the connection,     possibly resulting in a crash or a Denial of Service by CPU     consumption.
  Workaround :

    There is no known workaround at this time.

Lighttpd SA :

If the connection aborts during parsing '\r\n\r\n' the server might get into a infinite loop and use 100% of the CPU time. lighttpd still responses to other requests. This can be repeated until either the server limit for concurrent connections or file descriptors is reached.

The bug was reported and fixed by Robert Jakabosky.

The remote host is running Lighttpd, a small web server.  This version of Lighttpd is vulnerable to multiple Denial of Service (DoS) flaws.  An attacker exploiting these flaws would only need to be able to send data to the web server.  Successful exploitation would result in the attacker crashing the web server.

ID	Name	Product	Family	Severity
27339	openSUSE 10 Security Update : lighttpd (lighttpd-3090)	Nessus	SuSE Local Security Checks	high
25465	Debian DSA-1303-1 : lighttpd - denial of service	Nessus	Debian Local Security Checks	high
25184	GLSA-200705-07 : Lighttpd: Two Denials of Service	Nessus	Gentoo Local Security Checks	high
25052	FreeBSD : lighttpd -- Remote DOS in CRLF parsing (d2b48d30-ea97-11db-a802-000fea2763ce)	Nessus	FreeBSD Local Security Checks	medium
3969	Lighttpd < 1.4.14 Multiple DoS	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2007-1869

high

Tenable Plugins

high

high

high

medium

medium