lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference.

Two remotely exploitable DoS vulnerabilities in lighttpd can be used to crash lighttpd or make it waste CPU time in an enless loop (CVE-2007-1869, CVE-2007-1870).

Two problems were discovered with lighttpd, a fast webserver with minimal memory footprint, which could allow denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1869     Remote attackers could cause denial of service by     disconnecting partway through making a request.

  - CVE-2007-1870     A NULL pointer dereference could cause a crash when     serving files with a mtime of 0.

The remote host is affected by the vulnerability described in GLSA-200705-07 (Lighttpd: Two Denials of Service)

    Robert Jakabosky discovered an infinite loop triggered by a connection     abort when Lighttpd processes carriage return and line feed sequences.
    Marcus Rueckert discovered a NULL pointer dereference when a server     running Lighttpd tries to access a file with a mtime of 0.
  Impact :

    A remote attacker could upload a specially crafted file to the server     or send a specially crafted request and then abort the connection,     possibly resulting in a crash or a Denial of Service by CPU     consumption.
  Workaround :

    There is no known workaround at this time.

Lighttpd SA :

Lighttpd caches the rendered string for mtime. The cache key has as a default value 0. At that point the pointer to the string are still NULL. If a file with an mtime of 0 is requested it tries to access the pointer and crashes.

The bug requires that a malicious user can either upload files or manipulate the mtime of the files.

The bug was reported by cubiq and fixed by Marcus Rueckert.

The remote host is running Lighttpd, a small web server.  This version of Lighttpd is vulnerable to multiple Denial of Service (DoS) flaws.  An attacker exploiting these flaws would only need to be able to send data to the web server.  Successful exploitation would result in the attacker crashing the web server.

ID	Name	Product	Family	Severity
27339	openSUSE 10 Security Update : lighttpd (lighttpd-3090)	Nessus	SuSE Local Security Checks	high
25465	Debian DSA-1303-1 : lighttpd - denial of service	Nessus	Debian Local Security Checks	high
25184	GLSA-200705-07 : Lighttpd: Two Denials of Service	Nessus	Gentoo Local Security Checks	high
25049	FreeBSD : lighttpd -- DOS when access files with mtime 0 (5678da43-ea99-11db-a802-000fea2763ce)	Nessus	FreeBSD Local Security Checks	high
3969	Lighttpd < 1.4.14 Multiple DoS	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2007-1870

high

Tenable Plugins

high

high

high

high

medium