mod_access.c in lighttpd 1.4.15 ignores trailing / (slash) characters in the URL, which allows remote attackers to bypass url.access-deny settings.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.16. It is, therefore, affected by multiple vulnerabilities :

  - mod_auth allows remote attackers to cause a denial of service     via unspecified vectors involving (1) a memory leak, (2) use     of md5-sess without a cnonce, (3) base64 encoded strings, and     (4) trailing whitespace in the Auth-Digest header.
    (CVE-2007-3946)

  - The server allows remote attackers to cause a denial of     service by sending an HTTP request with duplicate headers.
    (CVE-2007-3947)

  - The server might accept more connections than the configured     maximum, which allows remote attackers to cause a denial of     service via a large number of connection attempts.
    (CVE-2007-3948)

  - mod_access ignores trailing / (slash) characters in the URL,     which allows remote attackers to bypass url.access-deny settings     (CVE-2007-3949)

  - The server, when run on 32 bit platforms, allows remote attackers     to cause a denial of service (daemon crash) via unspecified vectors     involving the use of incompatible format specifiers in certain     debugging messages in the (1) mod_scgi, (2) mod_fastcgi, and     (3) mod_webdav modules. (CVE-2007-3950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple bugs in lighttpd allowed remote attackers to crash lighttpd, circumvent access restricions or even execute code. (CVE-2007-3946, CVE-2007-3947, CVE-2007-3948, CVE-2007-3949, CVE-2007-3950)

Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint, which could allow the execution of arbitrary code via the overflow of CGI variables when mod_fcgi was enabled. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3946     The use of mod_auth could leave to a denial of service     attack crashing the webserver.

  - CVE-2007-3947     The improper handling of repeated HTTP headers could     cause a denial of service attack crashing the webserver.

  - CVE-2007-3949     A bug in mod_access potentially allows remote users to     bypass access restrictions via trailing slash     characters.

  - CVE-2007-3950     On 32-bit platforms users may be able to create denial     of service attacks, crashing the webserver, via     mod_webdav, mod_fastcgi, or mod_scgi.

The remote host is affected by the vulnerability described in GLSA-200708-11 (Lighttpd: Multiple vulnerabilities)

    Stefan Esser discovered errors with evidence of memory corruption in     the code parsing the headers. Several independent researchers also     reported errors involving the handling of HTTP headers, the mod_auth     and mod_scgi modules, and the limitation of active connections.
  Impact :

    A remote attacker can trigger any of these vulnerabilities by sending     malicious data to the server, which may lead to a crash or memory     exhaustion, and potentially the execution of arbitrary code.
    Additionally, access-deny settings can be evaded by appending a final /     to a URL.
  Workaround :

    There is no known workaround at this time.

Secunia Advisory reports :

Some vulnerabilities have been reported in lighttpd, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS (Denial of Service).

ID	Name	Product	Family	Severity
106623	lighttpd < 1.4.16 Multiple Vulnerabilities	Nessus	Web Servers	high
27340	openSUSE 10 Security Update : lighttpd (lighttpd-3985)	Nessus	SuSE Local Security Checks	high
25962	Debian DSA-1362-2 : lighttpd - several vulnerabilities	Nessus	Debian Local Security Checks	high
25917	GLSA-200708-11 : Lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25788	FreeBSD : lighttpd -- multiple vulnerabilities (fc9c217e-3791-11dc-bb1a-000fea449b8a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-3949

high

Tenable Plugins

high

high

high

high

high