lighttpd -- several vulnerabilities

2007-08-29T00:00:00
ID DSA-1362
Type debian
Reporter Debian
Modified 2007-08-29T00:00:00

Description

Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint, which could allow the execution of arbitrary code via the overflow of CGI variables when mod_fcgi was enabled. The Common Vulnerabilities and Exposures project identifies the following problems:

The use of mod_auth could leave to a denial of service attack crashing the webserver.

The improper handling of repeated HTTP headers could cause a denial of service attack crashing the webserver.

A bug in mod_access potentially allows remote users to bypass access restrictions via trailing slash characters.

On 32-bit platforms users may be able to create denial of service attacks, crashing the webserver, via mod_webdav, mod_fastcgi, or mod_scgi.

For the stable distribution (etch), these problems have been fixed in version 1.4.13-4etch4.

For the unstable distribution (sid), these problems have been fixed in version 1.4.16-1.

We recommend that you upgrade your lighttpd package.