lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.19. Therefore, it may be, affected by the following vulnerabilities :

  - lighttpd does not properly calculate the size of a file descriptor     array, which allows remote attackers to cause a denial of service     (crash) via a large number of connections, which triggers an     out-of-bounds access.

  - lighttpd sends the source code of CGI scripts instead of a 500     error when a fork failure occurs, which might allow remote     attackers to obtain sensitive information.

  - When userdir.path is not set, uses a default of $HOME, which     might allow remote attackers to read arbitrary files.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several local/remote vulnerabilities have been discovered in lighttpd, a fast webserver with minimal memory footprint.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0983     lighttpd 1.4.18, and possibly other versions before     1.5.0, does not properly calculate the size of a file     descriptor array, which allows remote attackers to cause     a denial of service (crash) via a large number of     connections, which triggers an out-of-bounds access. 

  - CVE-2007-3948     connections.c in lighttpd before 1.4.16 might accept     more connections than the configured maximum, which     allows remote attackers to cause a denial of service     (failed assertion) via a large number of connection     attempts.

- Remote attackers were able to crash lighttpd by opening     a large number of connections (CVE-2008-0983).

  - A bug in mod_cgi allowed remote attackers to read cgi     source files (CVE-2008-1111).

  - A bug in mod_userdir allowed remote attackers to read     arbitrary files (CVE-2008-1270).

The remote host is affected by the vulnerability described in GLSA-200803-10 (lighttpd: Multiple vulnerabilities)

    lighttpd contains a calculation error when allocating the global file     descriptor array (CVE-2008-0983). Furthermore, it sends the source of a     CGI script instead of returning a 500 error (Internal Server Error)     when the fork() system call fails (CVE-2008-1111).
  Impact :

    A remote attacker could exploit these vulnerabilities to cause a Denial     of Service or gain the source of a CGI script.
  Workaround :

    There is no known workaround at this time.

- Tue Mar 4 2008 Matthias Saou <http://freshrpms.net/>     1.4.18-6

    - Include patch for CVE-2008-0983 (crash when low on       file descriptors).

    - Include patch for CVE-2008-1111 (cgi source       disclosure).

    - Tue Feb 19 2008 Fedora Release Engineering <rel-eng at       fedoraproject.org>

    - Autorebuild for GCC 4.3

    - Wed Dec 5 2007 Release Engineering <rel-eng at       fedoraproject dot org>

    - Rebuild for deps

    - Wed Oct 31 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-3

    - Update mod_geoip source to fix segfault upon stopping       lighttpd.

    - Mon Oct 22 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-2

    - Include mod_geoip additional source, make it an       optional sub-package.

    - Reorder sub-packages alphabetically in spec file.

    - Make sub-packages require exact release, just in case.

    - Change default webroot back from /srv to /var.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Mar 4 2008 Matthias Saou <http://freshrpms.net/>     1.4.18-3

    - Include patch for CVE-2008-0983 (crash when low on       file descriptors).

    - Include patch for CVE-2008-1111 (cgi source       disclosure).

    - Tue Oct 16 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-2

    - Include mod_geoip additional source, make it an       optional sub-package.

    - Reorder sub-packages alphabetically in spec file.

    - Mon Sep 10 2007 Matthias Saou <http://freshrpms.net/>       1.4.18-1

    - Update to 1.4.18.

    - Include newly installed lighttpd-angel ('angel'       process meant to always run as root and restart       lighttpd when it crashes, spawn processes on SIGHUP),       but it's in testing stage and must be run with -D for       now.

  - Wed Sep 5 2007 Matthias Saou <http://freshrpms.net/>     1.4.17-1

    - Update to 1.4.17.

    - Update defaultconf patch to match new example       configuration.

    - Include patch to fix log file rotation with       max-workers set (trac #902).

    - Add /var/run/lighttpd/ directory where to put fastcgi       sockets.

    - Thu Aug 23 2007 Matthias Saou <http://freshrpms.net/>       1.4.16-3

    - Add /usr/bin/awk build requirement, used to get       LIGHTTPD_VERSION_ID.

    - Wed Aug 22 2007 Matthias Saou <http://freshrpms.net/>       1.4.16-2

    - Rebuild to fix wrong execmem requirement on ppc32.

    - Thu Jul 26 2007 Matthias Saou <http://freshrpms.net/>       1.4.16-1

    - Update to 1.4.16 security fix release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
106624	lighttpd < 1.4.19 Multiple Vulnerabilities	Nessus	Web Servers	medium
33507	Debian DSA-1609-1 : lighttpd - various	Nessus	Debian Local Security Checks	medium
31775	openSUSE 10 Security Update : lighttpd (lighttpd-5107)	Nessus	SuSE Local Security Checks	medium
31385	GLSA-200803-10 : lighttpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31372	Fedora 8 : lighttpd-1.4.18-6.fc8 (2008-2278)	Nessus	Fedora Local Security Checks	medium
31371	Fedora 7 : lighttpd-1.4.18-3.fc7 (2008-2262)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-0983

high

Tenable Plugins

medium

medium

medium

medium

medium

medium