Vulnerability in lighttpd: several
Summary
DSA-2368-1: lighttpd - several. Affects lighttpd versions < 1.4.28-2+squeeze1. Fixed in 1.4.28-2+squeeze1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lighttpd is a small and fast web server with minimal memory footprint. It is commonly used for serving static and dynamic content over HTTP. This vulnerability affects lighttpd versions 1.4.19-5+lenny3 and 1.4.28-2+squeeze1 in the Debian ecosystem.
Vulnerability Detail
The vulnerability consists of two separate issues:
-
CVE-2011-4362: This vulnerability allows an attacker to cause a Denial of Service (DoS) by exploiting a signedness issue in the base64 decoding routine used for HTTP authentication. By providing specially crafted input, an attacker can trigger an out-of-bounds read, leading to a crash of the lighttpd server.
-
CVE-2011-3389: This vulnerability is not specific to lighttpd but affects SSL/TLS communication using CBC ciphers. It allows a man-in-the-middle attacker to obtain plaintext HTTP traffic by exploiting a chosen-boundary attack on an HTTPS session. Lighttpd provides a workaround to mitigate this issue by disabling CBC ciphers.
How To Fix
Minimum fixed version
1.4.28-2+squeeze1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lighttpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the CVE-2011-3389 vulnerability, lighttpd offers a workaround by disabling CBC ciphers. This can be done by modifying the server configuration to exclude CBC ciphers from the list of supported ciphers. Here is an example configuration snippet:
ssl.cipher-list = "!AES128-SHA"
Please note that disabling CBC ciphers may impact compatibility with older clients.
Conclusion
In conclusion, the lighttpd web server is affected by two vulnerabilities: CVE-2011-4362 and CVE-2011-3389. It is crucial to upgrade to the latest version of lighttpd and apply the recommended workaround to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lighttpd →
FAQ
The impact of CVE-2011-4362 is a Denial of Service (DoS) condition, where an attacker can crash the lighttpd server by exploiting a signedness issue in the base64 decoding routine.
No, CVE-2011-3389 is not specific to lighttpd. It affects SSL/TLS communication using CBC ciphers. Lighttpd provides a workaround to mitigate this issue by disabling CBC ciphers.
To fix the CVE-2011-3389 vulnerability, it is recommended to upgrade to the latest version of lighttpd. Additionally, you can apply the provided workaround by modifying the server configuration to disable CBC ciphers.
Yes, disabling CBC ciphers may impact compatibility with older clients. It is recommended to test the compatibility of your clients before applying the workaround.
You can find more information about this vulnerability in the Debian Security Advisory DSA-2368-1.
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.