Published: 24/12/2011 Updated: 04/03/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 prior to 1.4.30 and 1.5 before SVN revision 2806 allows remote malicious users to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.

Vulnerable Product	Search on Vulmon	Subscribe to Product
lighttpd lighttpd
lighttpd lighttpd 1.5.0
debian debian linux 5.0
debian debian linux 6.0
debian debian linux 7.0

Debian Bug report logs - #652726 CVE-2011-4362: DoS because of incorrect code in src/http_authc:67 Package: src:lighttpd; Maintainer for src:lighttpd is Debian QA Group <packages@qadebianorg>; Reported by: Mahyuddin Susanto <udienz@ubuntucom> Date: Tue, 20 Dec 2011 10:12:23 UTC Severity: grave Tags: fixed-upstrea ...

Several vulnerabilities have been discovered in lighttpd, a small and fast webserver with minimal memory footprint CVE-2011-4362 Xi Wang discovered that the base64 decoding routine which is used to decode user input during an HTTP authentication, suffers of a signedness issue when processing user input As a result it is possible to force ...

Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_authc) in lighttpd 14 before 1430 and 15 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index ...

29 of November 2011 was the date of public disclosure interesting vulnerability in lighttpd server Xi Wang discovered that mod_auth for this server does not propely decode characters from the extended ASCII table The vulnerable code is below: "src/http_authc:67" --- CUT --- static const short base64_reverse_table[256] = ; static unsigned ch ...

Lighttpd versions before 1430 and 15 before SVN revision 2806 out-of-bounds read segmentation fault denial of service exploit ...

NVD-CWE-Other http://www.debian.org/security/2011/dsa-2368 http://secunia.com/advisories/47260 https://bugzilla.redhat.com/show_bug.cgi?id=758624 http://www.securitytracker.com/id?1026359 http://redmine.lighttpd.net/issues/2370 http://www.openwall.com/lists/oss-security/2011/11/29/8 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt http://www.openwall.com/lists/oss-security/2011/11/29/13 http://blog.pi3.com.pl/?p=277 http://archives.neohapsis.com/archives/bugtraq/2011-12/0167.html http://www.exploit-db.com/exploits/18295 https://exchange.xforce.ibmcloud.com/vulnerabilities/71536 http://jvn.jp/en/jp/JVN37417423/index.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652726 https://www.exploit-db.com/exploits/18295/https://www.debian.org/security/./dsa-2368

CVE-2011-4362

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect