FreeBSD : lighttpd -- DOS when access files with mtime 0 (5678da43-ea99-11db-a802-000fea2763ce)
High Nessus Plugin ID 25049
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionLighttpd SA :
Lighttpd caches the rendered string for mtime. The cache key has as a default value 0. At that point the pointer to the string are still NULL. If a file with an mtime of 0 is requested it tries to access the pointer and crashes.
The bug requires that a malicious user can either upload files or manipulate the mtime of the files.
The bug was reported by cubiq and fixed by Marcus Rueckert.
SolutionUpdate the affected package.