1428 matches found
Fedora 7 : lighttpd-1.4.18-1.fc7 (2007-2132)
Lighttpd 1.4.17 and earlier is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. This 1.4.18 update fixes the issue. Note that Tenable Network Security has extracted the preceding description block directly from t...
openSUSE 10 Security Update : lighttpd (lighttpd-3985)
Multiple bugs in lighttpd allowed remote attackers to crash lighttpd, circumvent access restricions or even execute code. CVE-2007-3946, CVE-2007-3947, CVE-2007-3948, CVE-2007-3949, CVE-2007-3950 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
openSUSE 10 Security Update : lighttpd (lighttpd-4532)
This update fixes a buffer overflow in the fcgienvadd function. Under some circumstances this bug allows remote code execution. CVE-2007-4727 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...
openSUSE 10 Security Update : lighttpd (lighttpd-3090)
Two remotely exploitable DoS vulnerabilities in lighttpd can be used to crash lighttpd or make it waste CPU time in an enless loop CVE-2007-1869, CVE-2007-1870. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...
HTML Injection Vuln in nssboard
Nssboard, formerly Simple PHP forum, is vulnerable to HTML injection including scripts possible XSS in two ways: 1. If BBcode is disabled, HTML tags are no longer stripped, allowing XSS attacks, etc. 2. Profile information user, email, Real Name is not filtered. For example a user could use...
[SECURITY] [DSA 1362-2] New lighttpd packages fix buffer overflow
------------------------------------------------------------------------ Debian Security Advisory 1362-2 [email protected] http://www.debian.org/security/ Steve Kemp October 7th, 2007 http://www.debian.org/security/faq - ------------------------------------------------------------------------...
GLSA-200709-16 : Lighttpd: Buffer overflow
The remote host is affected by the vulnerability described in GLSA-200709-16 Lighttpd: Buffer overflow Mattias Bengtsson and Philip Olausson have discovered a buffer overflow vulnerability in the function fcgienvadd in the file modfastcgi.c when processing overly long HTTP headers. Impact : A...
Lighttpd: Buffer overflow
Background Lighttpd is a lightweight HTTP web server. Description Mattias Bengtsson and Philip Olausson have discovered a buffer overflow vulnerability in the function fcgienvadd in the file modfastcgi.c when processing overly long HTTP headers. Impact A remote attacker could send a specially...
Lighttpd 1.4.17 - FastCGI Header Overflow Arbitrary Code Execution
/ hoagielighttpd.c LIGHTTPD/FASTCGI REMOTE EXPLOIT Philip Olausson http://www.secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ FastCGI: http://www.fastcgi.com/devkit/doc/fcgi-spec.html THIS FILE IS FOR STUDYING PURPOSES ONLY AND A PROOF-OF- CONCEPT. THE AUTHOR CAN NOT BE HELD...
Lighttpd <= 1.4.17 FastCGI Header Overflow Remote Exploit
Exploit for linux platform in category remote exploits ========================================================= Lighttpd Philip Olausson http://www.secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ FastCGI: http://www.fastcgi.com/devkit/doc/fcgi-spec.html THIS FILE IS FOR STUDYING...
Lighttpd 1.4.17 - FastCGI Header Overflow Arbitrary Code Execution
Lighttpd 1.4.17 - FastCGI Header Overflow Arbitrary Code Execution / hoagielighttpd.c LIGHTTPD/FASTCGI REMOTE EXPLOIT Philip Olausson http://www.secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ FastCGI: http://www.fastcgi.com/devkit/doc/fcgi-spec.html THIS FILE IS FOR STUDYING...
Lighttpd <= 1.4.17 FastCGI Header Overflow Remote Exploit
No description provided by source. / hoagielighttpd.c LIGHTTPD/FASTCGI REMOTE EXPLOIT = 1.4.17 Bug discovered by: Mattias Bengtsson [email protected] Philip Olausson [email protected] http://www.secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ FastCGI:...
lighttpd mod_fastcgi HTTP Request Header Remote Overflow
The remote web server appears to be lighttpd running with the FastCGI module modfastcgi. The version of the FastCGI module on the remote host is affected by a buffer overflow vulnerability. A remote attacker can exploit this, by sending a specially crafted request with a long header, to add or...
lighttpd Status Module Remote Information Disclosure
The instance of lighttpd running on the remote host allows unauthenticated access to URLs associated with the Status module modstatus, at least from the Nessus server. Modstatus reports information about how the web server is configured and its usage, and it may prove useful to an attacker seekin...
lighttpd buffer overflow
modfastcgi buffer overflow on headers parsing...
[Full-disclosure] rPSA-2007-0183-1 lighttpd
rPath Security Advisory: 2007-0183-1 Published: 2007-09-14 Products: rPath Linux 1 Rating: Severe Exposure Level Classification: Remote System User Deterministic Unauthorized Access Updated Versions: lighttpd=/conary.rpath.com@rpl:devel//1/1.4.18-0.1-1 References:...
FreeBSD : lighttpd -- FastCGI header overrun in mod_fastcgi (4b673ae7-5f9a-11dc-84dd-000102cc8983)
lighttpd maintainer reports : Lighttpd is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. For a detailed description of the bug see the external reference. This bug was found by Mattias Bengtsson and Philip...
DEBIAN-CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
Buffer overflow
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...