| Description: | Summary:
The remote host is missing an update for the Debian 'lighttpd' package(s) announced via the DSA-1362-1 advisory.
Vulnerability Insight:
Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint, which could allow the execution of arbitrary code via the overflow of CGI variables when mod_fcgi was enabled. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2007-3946
The use of mod_auth could leave to a denial of service attack crashing the webserver.
CVE-2007-3947
The improper handling of repeated HTTP headers could cause a denial of service attack crashing the webserver.
CVE-2007-3949
A bug in mod_access potentially allows remote users to bypass access restrictions via trailing slash characters.
CVE-2007-3950
On 32-bit platforms users may be able to create denial of service attacks, crashing the webserver, via mod_webdav, mod_fastcgi, or mod_scgi.
For the stable distribution (etch), these problems have been fixed in version 1.4.13-4etch4.
For the unstable distribution (sid), these problems have been fixed in version 1.4.16-1.
We recommend that you upgrade your lighttpd package.
Affected Software/OS:
'lighttpd' package(s) on Debian 4.
Solution:
Please install the updated package(s).
CVSS Score:
8.3
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:C
|
