[Full-disclosure] rPSA-2007-0072-1 lighttpd



rPath Security Advisory: 2007-0072-1
Published: 2007-04-18
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
Remote Deterministic Denial of Service
Updated Versions:
lighttpd=/conary.rpath.com@rpl:devel//1/1.4.15-0.1-1

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1869
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1870
https://issues.rpath.com/browse/RPL-1218

Description:
Previous versions of the lighttpd package are vulnerable to two denial
of service attacks. One is a remote denial of service that can cause
lighttpd to consume all available CPU time and stop serving requests,
and the other is a denial of service attack which generally requires
a local user to create a file with an mtime of 0; the lighttpd daemon
will crash when attempting to serve that file. This crash does not
enable any arbitrary or directed code execution.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • rPSA-2007-0072-1 lighttpd
    ... rPath Security Advisory: 2007-0072-1 ... Previous versions of the lighttpd package are vulnerable to two denial ... of service attacks. ... will crash when attempting to serve that file. ...
    (Bugtraq)
  • [Full-disclosure] FLEA-2007-0011-1: lighttpd
    ... Foresight Linux Essential Advisory: 2007-0011-1 ... service attacks. ... One is a remote denial of service that can cause lighttpd to ... subsequent updates using the Foresight System Manager ...
    (Full-Disclosure)
  • FLEA-2007-0011-1: lighttpd
    ... Previous versions of the lighttpd package are vulnerable to two denial of service attacks. ... One is a remote denial of service that can cause lighttpd to consume all available CPU time and stop serving requests, and the other is a denial of service attack which generally requires a local user to create a file with an mtime of 0; the lighttpd daemon will crash when attempting to serve that file. ... This crash does not enable any arbitrary or directed code execution; however, since the rAA service (Foresight System Manager) uses lighttpd by default, and rAA is configured to start by default, all Foresight systems are vulnerable to this DoS by default. ...
    (Bugtraq)