Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

lighttpd < 1.4.20 Multiple Vulnerabilities

Medium

Synopsis

The remote web server may be affected by several issues.

Description

According to its banner, the version of lighttpd installed on the remote host is older than 1.4.20. Such versions may be affected by several issues, including :

- SSL connections could be shut down by a remote attacker. - URL rewrite and redirect patterns can be circumvented by encoding. - mod_userdir does not sanitize URLs, which could lead to an information disclosure on case insensitive file systems e.g. http://example.com/~user/file.PHP would get the source code of file.php, instead of running the script. - The server leaks memory when it processes duplicate headers. This could lead to a denial of service by resource exhaustion.

Solution

Upgrade to version 1.4.20 or higher.