Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

Bugtraq ID:	31599
Class:	Input Validation Error
CVE:	CVE-2008-4359
Remote:	Yes
Local:	No
Published:	Oct 06 2008 12:00AM
Updated:	Apr 13 2015 09:29PM
Credit:	Gaetan Bisson
Vulnerable:	S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 rPath rPath Linux 2 rPath rPath Linux 1 lighttpd lighttpd 1.4.19 lighttpd lighttpd 1.4.18 lighttpd lighttpd 1.4.17 lighttpd lighttpd 1.4.16 lighttpd lighttpd 1.4.15 lighttpd lighttpd 1.4.14 lighttpd lighttpd 1.4.13 lighttpd lighttpd 1.4.12 lighttpd lighttpd 1.4.11 lighttpd lighttpd 1.4.10 lighttpd lighttpd 1.4.9 lighttpd lighttpd 1.4.8 lighttpd lighttpd 1.4.7 lighttpd lighttpd 1.4.6 lighttpd lighttpd 1.4.5 lighttpd lighttpd 1.4.4 lighttpd lighttpd 1.4.3 lighttpd lighttpd 1.4.2 lighttpd lighttpd 1.4.1 lighttpd lighttpd 1.4 lighttpd lighttpd 1.3.10 lighttpd lighttpd 1.3.8 lighttpd lighttpd 1.3.7 lighttpd lighttpd 1.4.10a Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	lighttpd lighttpd 1.4.20

Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

Lighttpd is prone to an information-disclosure vulnerability because it performs redirect operations on URIs before decoding them.

Attackers can exploit this issue to bypass expected filters or rewrite rules and may gain unauthorized access to certain resources. Other attacks may also be possible.

Versions prior to Lighttpd 1.4.20 are vulnerable.

Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Debian Linux 4.0 arm

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-cml_1.4.13-4etch3_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch3_arm.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_arm.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_arm.deb


• Debian lighttpd_1.4.13-4etch11_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_arm.deb

Debian Linux 4.0 powerpc

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch3_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch3_powerpc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_powerpc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_powerpc.deb


• Debian lighttpd_1.4.13-4etch11_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_powerpc.deb

Debian Linux 4.0 m68k

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 amd64

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_amd64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch3_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch3_amd64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_amd64.deb


• Debian lighttpd_1.4.13-4etch11_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_amd64.deb

Debian Linux 4.0 ia-32

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_i386.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch3_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch3_i386.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_i386.deb


• Debian lighttpd_1.4.13-4etch11_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_i386.deb

Debian Linux 4.0 hppa

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_hppa.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch3_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch3_hppa.deb


• Debian lighttpd_1.4.13-4etch11_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_hppa.deb

Debian Linux 4.0 sparc

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_sparc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch3_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch3_sparc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_sparc.deb


• Debian lighttpd_1.4.13-4etch11_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_sparc.deb

Debian Linux 4.0 s/390

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_s390.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch3_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch3_s390.deb


• Debian lighttpd_1.4.13-4etch11_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_s390.deb

Debian Linux 4.0 alpha

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch3_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch3_alpha.deb

Debian Linux 4.0

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb

Debian Linux 4.0 mipsel

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch3_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch3_mipsel.deb

Debian Linux 4.0 ia-64

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch3_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch3_ia64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_ia64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_ia64.deb


• Debian lighttpd_1.4.13-4etch11_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_ia64.deb

Debian Linux 4.0 mips

• Debian lighttpd-doc_1.4.13-4etch11_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch11_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch3_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch3_mips.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch11_mips.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch11_mips.deb


• Debian lighttpd_1.4.13-4etch11_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch11_mips.deb

Lighttpd URI Rewrite/Redirect Information Disclosure Vulnerability

References:

• lighttpd Homepage (lighttpd)
  
• Rewrite/redirect rules and URL encoding (Lighttpd)
  
• lighttpd-sa-2008-05: Bypass rewrite/redirect rules with encoded urls (Lighttpd)