Vulnerabilities in lighttpd
Summary
DSA-1362-1: lighttpd - several vulnerabilities. Affects lighttpd versions < 1.4.13-4etch4. Fixed in 1.4.13-4etch4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lighttpd is a fast web server with minimal memory footprint. It is vulnerable to several security issues that could allow the execution of arbitrary code, denial of service attacks, and bypassing of access restrictions. These vulnerabilities affect lighttpd when mod_fcgi, mod_auth, mod_access, mod_webdav, mod_fastcgi, or mod_scgi are enabled.
Vulnerability Detail
The vulnerabilities in lighttpd include:
-
CVE-2007-3946: The use of mod_auth could lead to a denial of service attack crashing the web server.
-
CVE-2007-3947: Improper handling of repeated HTTP headers could cause a denial of service attack crashing the web server.
-
CVE-2007-3949: A bug in mod_access potentially allows remote users to bypass access restrictions via trailing slash characters.
-
CVE-2007-3950: On 32-bit platforms, users may be able to create denial of service attacks, crashing the web server, via mod_webdav, mod_fastcgi, or mod_scgi.
How To Fix
Minimum fixed version
1.4.13-4etch4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lighttpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the lighttpd package to the recommended versions will address the vulnerabilities and improve the security of the web server. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for lighttpd →
FAQ
lighttpd is a fast web server with minimal memory footprint.
mod_fcgi is a module in lighttpd that enables FastCGI support.
mod_auth is a module in lighttpd that provides authentication support.
The vulnerabilities can be exploited to execute arbitrary code, crash the web server, or bypass access restrictions.
To upgrade the lighttpd package, you can use the package manager of your operating system or follow the instructions provided by the lighttpd project.
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
