Lighttpd Duplicate Request Header Denial of Service Vulnerability

Bugtraq ID:	31434
Class:	Design Error
CVE:	CVE-2008-4298
Remote:	Yes
Local:	No
Published:	Sep 26 2008 12:00AM
Updated:	Apr 16 2015 05:44PM
Credit:	Reported by Gentoo
Vulnerable:	SuSE openSUSE 10.3 S.u.S.E. openSUSE 10.2 rPath rPath Linux 2 rPath rPath Linux 1 lighttpd lighttpd 1.4.19 lighttpd lighttpd 1.4.18 lighttpd lighttpd 1.4.17 lighttpd lighttpd 1.4.16 lighttpd lighttpd 1.4.15 lighttpd lighttpd 1.4.14 lighttpd lighttpd 1.4.13 lighttpd lighttpd 1.4.12 lighttpd lighttpd 1.4.11 lighttpd lighttpd 1.4.10 lighttpd lighttpd 1.4.9 lighttpd lighttpd 1.4.8 lighttpd lighttpd 1.4.7 lighttpd lighttpd 1.4.6 lighttpd lighttpd 1.4.5 lighttpd lighttpd 1.4.4 lighttpd lighttpd 1.4.3 lighttpd lighttpd 1.4.2 lighttpd lighttpd 1.4.1 lighttpd lighttpd 1.4.10a Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	lighttpd lighttpd 1.4.20

Lighttpd Duplicate Request Header Denial of Service Vulnerability

The 'lighttpd' program is prone to a remote denial-of-service vulnerability because it fails to handle exceptional conditions.

Successfully exploiting this issue will allow attackers to cause the affected computer to leak memory, eventually denying service to legitimate users.

Versions prior to lighttpd 1.4.20 are vulnerable.

Lighttpd Duplicate Request Header Denial of Service Vulnerability

Attackers can use readily available network utilities to exploit this issue.

Lighttpd Duplicate Request Header Denial of Service Vulnerability

Solution:
Updates are available to address this issue. Please see the references for more information.


Debian Linux 4.0 arm

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_arm.deb


• Debian lighttpd_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_arm.deb

Debian Linux 4.0 powerpc

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_powerpc.deb


• Debian lighttpd_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_powerpc.deb

Debian Linux 4.0 m68k

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 amd64

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_amd64.deb


• Debian lighttpd_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_amd64.deb

Debian Linux 4.0 ia-32

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_i386.deb


• Debian lighttpd_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_i386.deb

Debian Linux 4.0 hppa

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_hppa.deb


• Debian lighttpd_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_hppa.deb

Debian Linux 4.0 sparc

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_sparc.deb


• Debian lighttpd_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_sparc.deb

Debian Linux 4.0 s/390

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_s390.deb


• Debian lighttpd_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_s390.deb

Debian Linux 4.0 alpha

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 mipsel

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 ia-64

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_ia64.deb


• Debian lighttpd_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_ia64.deb

Debian Linux 4.0 mips

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_mips.deb


• Debian lighttpd_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_mips.deb

Lighttpd Duplicate Request Header Denial of Service Vulnerability

References:

• lighttpd Homepage (lighttpd)
  
• www-servers/lighttpd < 1.4.20 duplicate request header DoS (memory consumption) (Gentoo)