LiteSpeed Web Server Multiple Unspecified Remote Security Vulnerabilities

Bugtraq ID:	36268
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2009 12:00AM
Updated:	Sep 09 2009 06:11PM
Credit:	Intevydis
Vulnerable:	Lite Speed Technologies LiteSpeed Web Server 3.3.19
Not Vulnerable:

LiteSpeed Web Server Multiple Unspecified Remote Security Vulnerabilities

LiteSpeed Web Server is prone to multiple unspecified remote security vulnerabilities, including:

- An error in 'lshttpd' that can be exploited to trigger an infinite loop.
- An unspecified security vulnerability that may require authenticated access.

Attackers can exploit these issues to execute code within the context of the affected server or to cause denial-of-service conditions.

LiteSpeed Web Server 3.3.19 is vulnerable; other versions may also be affected.

LiteSpeed Web Server Multiple Unspecified Remote Security Vulnerabilities

A working commercial exploit is available through Intevydis. This exploit is not otherwise publicly available or known to be circulating in the wild.

LiteSpeed Web Server Multiple Unspecified Remote Security Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LiteSpeed Web Server Multiple Unspecified Remote Security Vulnerabilities

References:

• LiteSpeed Homepage (LiteSpeed)
  
• VulnDisco Pack Professional (Intevydis)