Lucene search

CERTVU:312260

HistoryJul 09, 2024 - 12:00 a.m.

Use-after-free vulnerability in lighttpd version 1.4.50 and earlier

2024-07-0900:00:00

www.kb.cert.org

lighttpd

vulnerability

remote attacks

crash

memory leak

security update

supply-chain risk

web server

public disclosure

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.8

Confidence

High

EPSS

Percentile

10.6%

JSON

Overview

A use-after-free vulnerability in lighttpd in versions 1.4.50 and earlier permits a remote, unauthenticated attacker to trigger lighttpd to read from invalid pointers in memory. The attacker can use crafted HTTP Requests to crash the web server and/or leak memory in order to access sensitive data. This vulnerability was fixed in 2018 by the lighttpd project. However, a number of implementations of lighttpd remain vulnerable due to a failure to apply the security updates provided by lighttpd.

Description

lighttpd is a lightweight web server software that is meant for low resource environments with limited CPU and memory. This open-source software is available in binary form and source code that is included in various IoT and firmware environments. In November of 2018, VDOO researchers disclosed a vulnerability related to the HTTP header parsing code in lighttpd versions 1.4.50 and earlier. This security issue was fixed by lighttpd as part of their 1.4.51 release in August 2018. At the time of disclosure, VDOO researchers identified the primary impact to be Denial of Service (DoS) using the released memory pointer.

However, a CVE ID was not obtained as part of the fix outlined above, leaving the vulnerability without a public identifier. In April of 2024, Binarly discovered that the lighttpd vulnerability was still present in a number of products, presenting a supply-chain risk. The lack of CVE ID rendered the security fix invisible to projects that utilize earlier versions of lighttpd. Many organizations depend on a public CVE ID record to initiate security fixes and apply software updates. Binarly also documented many implementations of lighttpd (versions 1.4.50 and earlier) that allowed for a different set of attacks that can leak memory and access sensitive data. The supply-chain impact of this vulnerable software includes multiple products as highlighted in the blog by runZero. The lighttpd project has now obtained CVE-2018-25103 to identify this vulnerability and to alert supply-chain partners to implement the required fix.

Impact

The impact of this vulnerability varies largely due to the various ways lighttpd can be used a web server in various product implementations. In general, a remote unauthenticated attacker can use crafted HTTP Requests to crash the web server and/or leak memory in order to access sensitive data, such as process memory addresses.

Solution

The CERT/CC recommends applying the latest vendor-provided patch to address this issue. Review the Vendor Information below or contact your vendor or supplier for specific mitigation advice. If your device’s implementation of lighttpd is deemed end-of-life or end-of-support, replace your hardware or software as appropriate to avoid exposure to this vulnerability. Operators can also limit network access to lighttpd implementations to avoid exposure of this software to the public Internet and untrusted sources.

Acknowledgements

Thanks to Binarly for highlighting this vulnerability in supply-chain implementations. Thanks to Ori Hollander, VDOO for identifying and reporting the vulnerability in 2018. Thanks also to lighttpd project and vendor AMI that cooperated in supporting this public disclosure and outreach.This document was written by Vijay Sarvepalli.

Vendor Information

312260

Filter by status: All Affected Not Affected Unknown

Filter by content: __Additional information available

__Sort by: Status Alphabetical

Expand all

American Megatrends Incorporated (AMI) __ Affected

Notified: 2024-04-17 Updated: 2024-07-09

Statement Date: May 14, 2024

CVE-2018-25103	Affected

Vendor Statement

AMI has published an advisory to customers.

lighttpd __ Affected

Notified: 2024-04-17 Updated: 2024-07-09

Statement Date: April 23, 2024

CVE-2018-25103	Affected

Vendor Statement

lighttpd 1.4.50 and earlier have a use-after-free-vulnerability which might leak memory. Brute force attacks would have to guess exact matches. Guesses must not contain chars < 0x20 and would have to rely on stable contents of a specific, non-attacker-controlled memory location. On system not processing any other requests, and therefore with more stable memory location, the contents in freed memory are very unlikely to contain anything sensitive. This bug is read-only and not otherwise directly exploitable, but could theoretically be leveraged if other exploitable bugs were found.

References

Intel __ Not Affected

Notified: 2024-04-17 Updated: 2024-07-09

Statement Date: April 17, 2024

CVE-2018-25103	Not Affected

Vendor Statement

The only impacted Intel device is end of lifed. This was previously shared with Binarly. Due to it being EOL’d Intel will not be providing a mitigation.

CERT Addendum

Intel’s products are Affected by this vulnerability however these products have been identified as end-of-life by Intel. Users should replace these end-of-life products as they will not be fixed by Intel.