Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.4
CVSSv2

CVE-2007-3946

Published: 24/07/2007 Updated: 15/10/2018
CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10
VMScore: 570
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

Vulnerability Summary

mod_auth (http_auth.c) in lighttpd prior to 1.4.16 allows remote malicious users to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

lighttpd lighttpd

Vendor Advisories

Debian CVElist Bug Report Logs: Multiple vulnerabilities [CVE-2007-3946] [CVE-2007-3947] [CVE-2007-3948] [CVE-2007-3949] [CVE-2007-3950]
Debian Bug report logs - #434888 Multiple vulnerabilities [CVE-2007-3946] [CVE-2007-3947] [CVE-2007-3948] [CVE-2007-3949] [CVE-2007-3950] Package: lighttpd; Maintainer for lighttpd is Debian QA Group <packages@qadebianorg>; Source for lighttpd is src:lighttpd (PTS, buildd, popcon) Reported by: Adam Majer <adamm@zombino ...

References

NVD-CWE-Otherhttp://trac.lighttpd.net/trac/changeset/1875http://trac.lighttpd.net/trac/browser/branches/lighttpd-1.4.x/NEWS?rev=1875https://issues.rpath.com/browse/RPL-1550https://issues.rpath.com/browse/RPL-1554http://www.securityfocus.com/bid/24967http://secunia.com/advisories/26130http://secunia.com/advisories/26158http://www.debian.org/security/2007/dsa-1362http://security.gentoo.org/glsa/glsa-200708-11.xmlhttp://www.novell.com/linux/security/advisories/2007_15_sr.htmlhttp://secunia.com/advisories/26505http://secunia.com/advisories/26593http://www.vupen.com/english/advisories/2007/2585http://osvdb.org/38314http://osvdb.org/38315http://osvdb.org/38316http://osvdb.org/38317http://www.securityfocus.com/archive/1/474131/100/0/threadedhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=434888https://nvd.nist.gov
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367CVE-2024-3611CVE-2024-4947CVE-2024-32988CVE-2020-35165local file inclusionCVE-2024-4980bypassmalicious code‎
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook