Lighttpd: Denial of Service

Background

Lighttpd is a lightweight high-performance web server.

Description

Lighttpd’s mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received.

Impact

An attacker can trigger a denial of service via making Lighttpd try to call an uninitialized function pointer.

Workaround

There is no known workaround at this time.

Resolution

All lighttpd users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-servers/lighttpd-1.4.67"