Various issues have been fixed in lighttpd. CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360 have been assigned to thess issues.

Lighttpd seurity announcement :

lighttpd 1.4.19, and possibly other versions before 1.5.0, does not decode the url before matching against rewrite and redirect patterns, which allows attackers to bypass rewrites rules. this can be a security problem in certain configurations if these rules are used to hide certain urls.

lighttpd 1.4.19, and possibly other versions before 1.5.0, does not lowercase the filename after generating it from the url in mod_userdir on case insensitive (file)systems.

As other modules are case sensitive, this may lead to information disclosure; for example if one configured php to handle files ending on '.php', an attacker will get the php source with http://example.com/~user/file.PHP

lighttpd 1.4.19 does not always release a header if it triggered a 400 (Bad Request) due to a duplicate header.

The remote host is affected by the vulnerability described in GLSA-200812-04 (lighttpd: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in lighttpd:
    Qhy reported a memory leak in the http_request_parse() function in     request.c (CVE-2008-4298).
    Gaetan Bisson reported that URIs are not decoded before applying     url.redirect and url.rewrite rules (CVE-2008-4359).
    Anders1 reported that mod_userdir performs case-sensitive comparisons     on filename components in configuration options, which is insufficient     when case-insensitive filesystems are used (CVE-2008-4360).
  Impact :

    A remote attacker could exploit these vulnerabilities to cause a Denial     of Service, to bypass intended access restrictions, to obtain sensitive     information, or to possibly modify data.
  Workaround :

    There is no known workaround at this time.

This update fixes some moderate security issues and includes a few enhancements.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.20. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the     connection_state_machine() function that is triggered     when disconnecting before a download has finished. An     unauthenticated, remote attacker can exploit this to     cause all active SSL connections to be lost.
    (CVE-2008-1531)

  - A memory leak flaw exists in the http_request_parse()     function. An unauthenticated, remote attacker can     exploit this, via a large number of requests with     duplicate request headers, to cause a denial of service     condition. (CVE-2008-4298)

  - A security bypass vulnerability exists due to comparing     URIs to patterns in url.redirect and url.rewrite     configuration settings before performing URL decoding.
    An unauthenticated, remote attacker can exploit this to     bypass intended access restrictions, resulting in the     disclosure or modification of sensitive data.
    (CVE-2008-4359)

  - A security bypass vulnerability exists in mod_userdir     due to performing case-sensitive comparisons even on     case-insensitive operating systems and file systems. An     unauthenticated, remote attacker can exploit this to     bypass intended access restrictions, resulting in the     disclosure of sensitive information. (CVE-2008-4360)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several local/remote vulnerabilities have been discovered in lighttpd, a fast webserver with minimal memory footprint. 

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4298     A memory leak in the http_request_parse function could     be used by remote attackers to cause lighttpd to consume     memory, and cause a denial of service attack.

  - CVE-2008-4359     Inconsistant handling of URL patterns could lead to the     disclosure of resources a server administrator did not     anticipate when using rewritten URLs.

  - CVE-2008-4360     Upon filesystems which don't handle case-insensitive     paths differently it might be possible that     unanticipated resources could be made available by     mod_userdir.

This update fixes a regression caused by the last security update for CVE-2008-4360.

According to its banner, the version of lighttpd installed on the remote host is older than 1.4.20.  Such versions may be affected by several issues, including :

  - SSL connections could be shut down by a remote attacker.
  - URL rewrite and redirect patterns can be circumvented by encoding.
  - mod_userdir does not sanitize URLs, which could lead to an information disclosure on case insensitive file systems e.g. http://example.com/~user/file.PHP would get the source code of file.php, instead of running the script.
  - The server leaks memory when it processes duplicate headers. This could lead to a denial of service by resource exhaustion.

ID	Name	Product	Family	Published	Updated	Severity
40061	openSUSE Security Update : lighttpd (lighttpd-309)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high
34310	FreeBSD : lighttpd -- multiple vulnerabilities (fb911e31-8ceb-11dd-bb29-000c6e274733)	Nessus	FreeBSD Local Security Checks	9/29/2008	1/6/2021	high
35021	GLSA-200812-04 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/3/2008	1/6/2021	high
34812	openSUSE 10 Security Update : lighttpd (lighttpd-5785)	Nessus	SuSE Local Security Checks	11/18/2008	1/14/2021	high
35665	Fedora 9 : lighttpd-1.4.20-6.fc9 (2008-11923)	Nessus	Fedora Local Security Checks	2/13/2009	1/11/2021	high
34332	lighttpd < 1.4.20 Multiple Vulnerabilities	Nessus	Web Servers	10/3/2008	7/13/2018	high
34353	Debian DSA-1645-1 : lighttpd - various	Nessus	Debian Local Security Checks	10/7/2008	1/4/2021	high
42972	openSUSE Security Update : lighttpd (lighttpd-1586)	Nessus	SuSE Local Security Checks	12/2/2009	1/14/2021	high
42974	openSUSE Security Update : lighttpd (lighttpd-1586)	Nessus	SuSE Local Security Checks	12/2/2009	1/14/2021	high
4698	lighttpd < 1.4.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/3/2008	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

medium