Test ID:	1.3.6.1.4.1.25623.1.0.120162
Category:	Amazon Linux Local Security Checks
Title:	Amazon Linux: Security Advisory (ALAS-2014-299)
Summary:	The remote host is missing an update for the 'lighttpd' package(s) announced via the ALAS-2014-299 advisory.
Description:	Summary: The remote host is missing an update for the 'lighttpd' package(s) announced via the ALAS-2014-299 advisory. Vulnerability Insight: Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures. lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network. lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached. Affected Software/OS: 'lighttpd' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 7.6 CVSS Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4508 DSA-2795 https://www.debian.org/security/2013/dsa-2795 HPSBGN03191 http://marc.info/?l=bugtraq&m=141576815022399&w=2 JVN#37417423 http://jvn.jp/en/jp/JVN37417423/index.html [oss-security] 20131104 Re: CVE Request: lighttpd using vulnerable cipher suites with SNI http://openwall.com/lists/oss-security/2013/11/04/19 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt http://redmine.lighttpd.net/issues/2525 http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/ openSUSE-SU-2014:0072 http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html Common Vulnerability Exposure (CVE) ID: CVE-2013-4559 55682 http://secunia.com/advisories/55682 [oss-security] 20131112 Re: CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free) http://www.openwall.com/lists/oss-security/2013/11/12/4 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt https://kc.mcafee.com/corporate/index?page=content&id=SB10310 Common Vulnerability Exposure (CVE) ID: CVE-2013-4560 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.