1427 matches found
CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution
/ Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a "remove me" in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer="" localhost ./exploit localhost 80 /var/log/lighttpd/access.log Mattias Bengtsson...
Lighttpd <= 1.4.16 FastCGI Header Overflow Remote Exploit
Exploit for multiple platform in category remote exploits ========================================================= Lighttpd " localhost ./exploit localhost 80 /var/log/lighttpd/access.log Mattias Bengtsson http://www.secweb.se/ / include include include include include include include include...
Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution
Lighttpd 1.4.16 - FastCGI Header Overflow Remote Command Execution / Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a "remove me" in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer="" localhost ./exploit...
Lighttpd < 1.4.18 mod_fastcgi HTTP Request Header Overflow
Binary data 4206.prm...
Lighttpd <= 1.4.16 FastCGI Header Overflow Remote Exploit
No description provided by source. / Remote Lighttpd + FastCGI + PHP example exploit Tested with Lighttpd 1.4.16 and PHP 5.2.4 To avoid abuse there's a "remove me" in the code. Example: ./exploit localhost 80 /etc/passwd or wget --referer="?php system'/usr/bin/id'; ?" localhost ./exploit localhos...
lighttpd -- FastCGI header overrun in mod_fastcgi
lighttpd maintainer reports: Lighttpd is prone to a header overflow when using the modfastcgi extension, this can lead to arbitrary code execution in the fastcgi application. For a detailed description of the bug see the external reference. This bug was found by Mattias Bengtsson and Philip Olaus...
Debian DSA-1362-2 : lighttpd - several vulnerabilities
Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint, which could allow the execution of arbitrary code via the overflow of CGI variables when modfcgi was enabled. The Common Vulnerabilities and Exposures project identifies the following problems : -...
[SECURITY] [DSA 1362-1] New lighttpd packages fix several vulnerabilities
------------------------------------------------------------------------ Debian Security Advisory DSA-1362 [email protected] http://www.debian.org/security/ Steve Kemp August 29th, 2007 http://www.debian.org/security/faq - ------------------------------------------------------------------------...
DSA-1362-1 lighttpd - several vulnerabilities
Bulletin has no description...
GLSA-200708-11 : Lighttpd: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200708-11 Lighttpd: Multiple vulnerabilities Stefan Esser discovered errors with evidence of memory corruption in the code parsing the headers. Several independent researchers also reported errors involving the handling of HTTP...
[ GLSA 200708-11 ] Lighttpd: Multiple vulnerabilities
Gentoo Linux Security Advisory GLSA 200708-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...
Lighttpd multiple security vulnerabilities
Multiple memory corruption on request headers parsing...
Lighttpd: Multiple vulnerabilities
Background Lighttpd is a lightweight HTTP web server. Description Stefan Esser discovered errors with evidence of memory corruption in the code parsing the headers. Several independent researchers also reported errors involving the handling of HTTP headers, the modauth and modscgi modules, and th...
[SECURITY] Fedora 7 Update: lighttpd-1.4.16-1.fc7
Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...
FreeBSD : lighttpd -- multiple vulnerabilities (fc9c217e-3791-11dc-bb1a-000fea449b8a)
Secunia Advisory reports : Some vulnerabilities have been reported in lighttpd, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS Denial of Service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
CVE-2007-3948
connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service failed assertion via a large number of connection attempts...
Code injection
connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum, which allows remote attackers to cause a denial of service failed assertion via a large number of connection attempts...
Cross site request forgery (csrf)
request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...
CVE-2007-3947
request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service daemon crash by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault...