It was discovered that lighttpd, a fast webserver with minimal memory footprint, didn't correctly handle SSL errors. This could allow a remote attacker to disconnect all active SSL connections.

The remote host is affected by the vulnerability described in GLSA-200804-08 (lighttpd: Multiple vulnerabilities)

    Julien Cayzax discovered that an insecure default setting exists in     mod_userdir in lighttpd. When userdir.path is not set the default value     used is $HOME. It should be noted that the 'nobody' user's $HOME is '/'     (CVE-2008-1270). An error also exists in the SSL connection code which     can be triggered when a user prematurely terminates his connection     (CVE-2008-1531).
  Impact :

    A remote attacker could exploit the first vulnerability to read     arbitrary files. The second vulnerability can be exploited by a remote     attacker to cause a Denial of Service by terminating a victim's SSL     connection.
  Workaround :

    As a workaround for CVE-2008-1270 you can set userdir.path to a     sensible value, e.g. 'public_html'.

An error in one SSL connection could lead to termination of all SSL connections (CVE-2008-1531)

Secunia reports :

A vulnerability has been reported in lighttpd, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to lighttpd not properly clearing the OpenSSL error queue. This can be exploited to close concurrent SSL connections of lighttpd by terminating one SSL connection.

This update fixes a bug where a user could kill another user's SSL connection by killing his own, because the SSL error queue wasn't cleared properly.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.20. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the     connection_state_machine() function that is triggered     when disconnecting before a download has finished. An     unauthenticated, remote attacker can exploit this to     cause all active SSL connections to be lost.
    (CVE-2008-1531)

  - A memory leak flaw exists in the http_request_parse()     function. An unauthenticated, remote attacker can     exploit this, via a large number of requests with     duplicate request headers, to cause a denial of service     condition. (CVE-2008-4298)

  - A security bypass vulnerability exists due to comparing     URIs to patterns in url.redirect and url.rewrite     configuration settings before performing URL decoding.
    An unauthenticated, remote attacker can exploit this to     bypass intended access restrictions, resulting in the     disclosure or modification of sensitive data.
    (CVE-2008-4359)

  - A security bypass vulnerability exists in mod_userdir     due to performing case-sensitive comparisons even on     case-insensitive operating systems and file systems. An     unauthenticated, remote attacker can exploit this to     bypass intended access restrictions, resulting in the     disclosure of sensitive information. (CVE-2008-4360)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of lighttpd installed on the remote host is older than 1.4.20.  Such versions may be affected by several issues, including :

  - SSL connections could be shut down by a remote attacker.
  - URL rewrite and redirect patterns can be circumvented by encoding.
  - mod_userdir does not sanitize URLs, which could lead to an information disclosure on case insensitive file systems e.g. http://example.com/~user/file.PHP would get the source code of file.php, instead of running the script.
  - The server leaks memory when it processes duplicate headers. This could lead to a denial of service by resource exhaustion.

ID	Name	Product	Family	Published	Updated	Severity
31810	Debian DSA-1540-1 : lighttpd - denial of service	Nessus	Debian Local Security Checks	4/11/2008	1/4/2021	medium
31955	GLSA-200804-08 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/17/2008	1/6/2021	medium
32129	openSUSE 10 Security Update : lighttpd (lighttpd-5216)	Nessus	SuSE Local Security Checks	5/2/2008	1/14/2021	medium
31953	FreeBSD : lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability (1ac77649-0908-11dd-974d-000fea2763ce)	Nessus	FreeBSD Local Security Checks	4/17/2008	1/6/2021	medium
32094	Fedora 7 : lighttpd-1.4.19-4.fc7 (2008-3343)	Nessus	Fedora Local Security Checks	5/1/2008	1/11/2021	medium
32100	Fedora 8 : lighttpd-1.4.19-4.fc8 (2008-3376)	Nessus	Fedora Local Security Checks	5/1/2008	1/11/2021	medium
32386	Fedora 9 : lighttpd-1.4.19-4.fc9 (2008-4119)	Nessus	Fedora Local Security Checks	5/20/2008	1/11/2021	medium
34332	lighttpd < 1.4.20 Multiple Vulnerabilities	Nessus	Web Servers	10/3/2008	7/13/2018	high
4698	lighttpd < 1.4.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/3/2008	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

high

medium