Detections
Analytics
FreeBSD : lighttpd -- multiple vulnerabilities (90b27045-9530-11e3-9d09-000c2980a9f3)
high Nessus Plugin ID 72494
Language:
Synopsis
The remote FreeBSD host is missing a security-related update.Description
lighttpd security advisories report :It is possible to inadvertantly enable vulnerable ciphers when using ssl.cipher-list.
In certain cases setuid() and similar can fail, potentially triggering lighttpd to restart running as root.
If FAMMonitorDirectory fails, the memory intended to store the context is released; some lines below the 'version' compoment of that context is read. Reading invalid data doesn't matter, but the memory access could trigger a segfault.
Solution
Update the affected package.See Also
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt
Plugin Details
Severity: High
ID: 72494
File Name: freebsd_pkg_90b27045953011e39d09000c2980a9f3.nasl
Version: 1.4
Type: local
Family: FreeBSD Local Security Checks
Published: 2/14/2014
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:lighttpd, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 2/14/2014
Vulnerability Publication Date: 11/28/2013