SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.35. It is, therefore, affected by the following vulnerabilities :

 - A SQL injection flaw exists in the 'mod_mysql_vhost' module where user input passed using the hostname is not properly sanitized. A remote attacker can exploit this to inject or manipulate SQL queries, resulting in the manipulation or disclosure of data. (CVE-2014-2323)

 - A traverse outside of restricted path flaw exists with the 'mod_evhost' and 'mod_simple_vhost' modules where user input passed using the hostname is not properly sanitized. A remote attacker can exploit this to gain access to potentially sensitive data. (CVE-2014-2324)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - SQL injection vulnerability in mod_mysql_vhost.c in     lighttpd before 1.4.35 allows remote attackers to     execute arbitrary SQL commands via the host name,     related to request_check_hostname. (CVE-2014-2323)

  - Multiple directory traversal vulnerabilities in (1)     mod_evhost and (2) mod_simple_vhost in lighttpd before     1.4.35 allow remote attackers to read arbitrary files     via a .. (dot dot) in the host name, related to     request_check_hostname. (CVE-2014-2324)

Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

The remote host is affected by the vulnerability described in GLSA-201406-10 (lighttpd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in lighttpd. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could create a Denial of Service condition.
      Futhermore, a remote attacker may be able to execute arbitrary SQL       statements.
  Workaround :

    There is no known workaround at this time.

lighttpd was updated to version 1.4.35, fixing bugs and security issues :

CVE-2014-2323: SQL injection vulnerability in mod_mysql_vhost.c in lighttpd allowed remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

CVE-2014-2323: Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd allowed remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

More information can be found on the lighttpd advisory page:
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt 

Other changes :

  - [network/ssl] fix build error if TLSEXT is disabled

  - [mod_fastcgi] fix use after free (only triggered if     fastcgi debug is active)

  - [mod_rrdtool] fix invalid read (string not null     terminated)

  - [mod_dirlisting] fix memory leak if pcre fails

  - [mod_fastcgi,mod_scgi] fix resource leaks on spawning     backends

  - [mod_magnet] fix memory leak

  - add comments for switch fall throughs

  - remove logical dead code

  - [buffer] fix length check in buffer_is_equal_right_len

  - fix resource leaks in error cases on config parsing and     other initializations

  - add force_assert() to enforce assertions as simple     assert()s are disabled by -DNDEBUG (fixes #2546)

  - [mod_cml_lua] fix NULL pointer dereference

  - force assertion: setting FD_CLOEXEC must work (if     available)

  - [network] check return value of lseek()

  - fix unchecked return values from     stream_open/stat_cache_get_entry

  - [mod_webdav] fix logic error in handling file creation     error

  - check length of unix domain socket filenames

  - fix SQL injection / host name validation (thx Jann Horn)     for all the changes see     /usr/share/doc/packages/lighttpd/NEWS

1.4.35, fixes SA-2014-01, CVE-2014-2323, CVE-2014-2324 

[1] http://seclists.org/oss-sec/2014/q1/561 [2] http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt [3] http://www.lighttpd.net/2014/3/12/1.4.35/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.35. It is, therefore, affected by the following vulnerabilities :

  - A SQL injection flaw exists in the 'mod_mysql_vhost'     module where user input passed using the hostname is not     properly sanitized. A remote attacker can exploit this     to inject or manipulate SQL queries, resulting in the     manipulation or disclosure of data. (CVE-2014-2323)

  - A traverse outside of restricted path flaw exists with     the 'mod_evhost' and 'mod_simple_vhost' modules where     user input passed using the hostname is not properly     sanitized. A remote attacker can exploit this to gain     access to potentially sensitive data. (CVE-2014-2324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the lighttpd web server.

  - CVE-2014-2323     Jann Horn discovered that specially crafted host names     can be used to inject arbitrary MySQL queries in     lighttpd servers using the MySQL virtual hosting module     (mod_mysql_vhost).

  This only affects installations with the lighttpd-mod-mysql-vhost   binary package installed and in use.

  - CVE-2014-2324     Jann Horn discovered that specially crafted host names     can be used to traverse outside of the document root     under certain situations in lighttpd servers using     either the mod_mysql_vhost, mod_evhost, or     mod_simple_vhost virtual hosting modules.

  Servers not using these modules are not affected.

Versions older than 1.4.35 are vulnerable to the following issues:

  - Insufficient user input sanitation on the hostname in the 'mod_mysql_vhost' module could be leveraged for a SQL injection attack (CVE-2014-2323)

  - Insufficient user input sanitation on the hostname in 'mod_evhost' and 'mod_simple_vhost' modules could be leveraged for directory traversal attacks (CVE-2014-2324)

ID	Name	Product	Family	Severity
112358	lighttpd < 1.4.35 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
80698	Oracle Solaris Third-Party Patch Update : lighttpd (multiple_vulnerabilities_in_lighttpd)	Nessus	Solaris Local Security Checks	high
78289	Amazon Linux AMI : lighttpd (ALAS-2014-346)	Nessus	Amazon Linux Local Security Checks	high
76062	GLSA-201406-10 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75308	openSUSE Security Update : lighttpd (openSUSE-SU-2014:0449-1)	Nessus	SuSE Local Security Checks	high
73194	Fedora 19 : lighttpd-1.4.35-1.fc19 (2014-3947)	Nessus	Fedora Local Security Checks	high
73193	Fedora 20 : lighttpd-1.4.35-1.fc20 (2014-3887)	Nessus	Fedora Local Security Checks	high
73123	lighttpd < 1.4.35 Multiple Vulnerabilities	Nessus	Web Servers	high
72992	Debian DSA-2877-1 : lighttpd - security update	Nessus	Debian Local Security Checks	high
8159	lighttpd < 1.4.35 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2014-2323

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

medium