Li Ming discovered that lighttpd, a small and fast webserver with minimal memory footprint, is vulnerable to a denial of service attack due to bad memory handling. Slowly sending very small chunks of request data causes lighttpd to allocate new buffers for each read instead of appending to old ones. An attacker can abuse this behaviour to cause denial of service conditions due to memory exhaustion.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.26 or is 1.5.0. It is, therefore, affected by the following vulnerabilities :

  - lighttpd allocates a buffer for each read operation which allows     remote attackers to cause a denial of service (memory consumption)     by breaking a request into small pieces that are sent at a slow rate.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update lighttpd to the latest version of the 1.4 branch, with the spawn-fcgi program split out for the first time on EL. This fixes CVE-2010-0295 and also includes a fix for upstream bug #2157 where SSL stopped working with RHEL 5.4.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a denial of service vulnerability in lighttpd that can be triggers using slow requests. (CVE-2010-0295)

Lighttpd security advisory reports :

If you send the request data very slow (e.g. sleep 0.01 after each byte), lighttpd will easily use all available memory and die (especially for parallel requests), allowing a DoS within minutes.

The remote host is affected by the vulnerability described in GLSA-201006-17 (lighttpd: Denial of Service)

    Li Ming reported that lighttpd does not properly process packets that     are sent overly slow.
  Impact :

    A remote attacker might send specially crafted packets to a server     running lighttpd, possibly resulting in a Denial of Service condition     via host memory exhaustion.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - lighttpd before 1.4.26, and 1.5.x, allocates a buffer     for each read operation that occurs for a request, which     allows remote attackers to cause a denial of service     (memory consumption) by breaking a request into small     pieces that are sent at a slow rate. (CVE-2010-0295)

  - The configuration file for the FastCGI PHP support for     lighthttpd before 1.4.28 on Debian GNU/Linux creates a     socket file with a predictable name in /tmp, which     allows local users to hijack the PHP control socket and     perform unauthorized actions such as forcing the use of     a different version of PHP via a symlink attack or a     race condition. (CVE-2013-1427)

  - Unspecified vulnerability in Lighthttpd in Oracle     Solaris 11.1 allows attackers to cause a denial of     service via unknown vectors. (CVE-2014-2469)

ID	Name	Product	Family	Published	Updated	Severity
44851	Debian DSA-1987-1 : lighttpd - denial of service	Nessus	Debian Local Security Checks	2/24/2010	1/4/2021	medium
106625	lighttpd < 1.4.26 or 1.5.0 Denial of Service	Nessus	Web Servers	2/6/2018	1/2/2019	medium
47469	Fedora 12 : lighttpd-1.4.26-2.fc12 (2010-7643)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
44410	openSUSE Security Update : lighttpd (lighttpd-1914)	Nessus	SuSE Local Security Checks	2/9/2010	1/14/2021	medium
47464	Fedora 13 : lighttpd-1.4.26-2.fc13 (2010-7611)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
44412	openSUSE Security Update : lighttpd (lighttpd-1914)	Nessus	SuSE Local Security Checks	2/9/2010	1/14/2021	medium
44409	openSUSE Security Update : lighttpd (lighttpd-1914)	Nessus	SuSE Local Security Checks	2/9/2010	1/14/2021	medium
44625	FreeBSD : lighttpd -- denial of service vulnerability (1a3bd81f-1b25-11df-bd1a-002170daae37)	Nessus	FreeBSD Local Security Checks	2/17/2010	1/6/2021	medium
46806	GLSA-201006-17 : lighttpd: Denial of Service	Nessus	Gentoo Local Security Checks	6/4/2010	1/6/2021	medium
47467	Fedora 11 : lighttpd-1.4.26-2.fc11 (2010-7636)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium
80699	Oracle Solaris Third-Party Patch Update : lighttpd (cve_2014_2469_denial_of)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium