lighttpd: Multiple vulnerabilities — GLSA 200812-04

Multiple vulnerabilities in lighttpd may lead to information disclosure or a Denial of Service.

Affected packages

Background

lighttpd is a lightweight high-performance web server.

Description

Multiple vulnerabilities have been reported in lighttpd:

• Qhy reported a memory leak in the http_request_parse() function in request.c (CVE-2008-4298).
• Gaetan Bisson reported that URIs are not decoded before applying url.redirect and url.rewrite rules (CVE-2008-4359).
• Anders1 reported that mod_userdir performs case-sensitive comparisons on filename components in configuration options, which is insufficient when case-insensitive filesystems are used (CVE-2008-4360).

Impact

A remote attacker could exploit these vulnerabilities to cause a Denial of Service, to bypass intended access restrictions, to obtain sensitive information, or to possibly modify data.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.20"

References

• CVE-2008-4298
• CVE-2008-4359
• CVE-2008-4360

Release date
December 02, 2008

Latest revision
December 02, 2008: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 238180