lighttpd Slow Request Handling Remote Denial Of Service Vulnerability

Bugtraq ID:	38036
Class:	Design Error
CVE:	CVE-2010-0295
Remote:	Yes
Local:	No
Published:	Feb 02 2010 12:00AM
Updated:	Apr 13 2015 09:22PM
Credit:	Li Ming
Vulnerable:	SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 Sun Solaris 11 Express Sun OpenSolaris snv_151a S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Oracle Solaris 11.1 lighttpd lighttpd 1.5 -pre lighttpd lighttpd 1.5 lighttpd lighttpd 1.4.26 lighttpd lighttpd 1.4.25 lighttpd lighttpd 1.4.24 lighttpd lighttpd 1.4.23 lighttpd lighttpd 1.4.20 lighttpd lighttpd 1.4.19 lighttpd lighttpd 1.4.18 lighttpd lighttpd 1.4.17 lighttpd lighttpd 1.4.16 lighttpd lighttpd 1.4.15 lighttpd lighttpd 1.4.14 lighttpd lighttpd 1.4.13 lighttpd lighttpd 1.4.12 lighttpd lighttpd 1.4.11 lighttpd lighttpd 1.4.10 lighttpd lighttpd 1.4.9 lighttpd lighttpd 1.4.8 lighttpd lighttpd 1.4.7 lighttpd lighttpd 1.4.6 lighttpd lighttpd 1.4.5 lighttpd lighttpd 1.4.4 lighttpd lighttpd 1.4.3 lighttpd lighttpd 1.4.2 lighttpd lighttpd 1.4.1 lighttpd lighttpd 1.4 lighttpd lighttpd 1.4.10a Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Oracle Solaris 11.1.17.5.0

lighttpd Slow Request Handling Remote Denial Of Service Vulnerability

The 'lighttpd' webserver is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the application to hang, denying service to legitimate users.

lighttpd Slow Request Handling Remote Denial Of Service Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/38036.sh

lighttpd Slow Request Handling Remote Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_ia64.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_ia64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_ia64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_ia64.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_ia64.deb


• Debian lighttpd_1.4.19-5+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_ia64.deb

Debian Linux 5.0 alpha

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_alpha.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_alpha.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_alpha.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_alpha.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_alpha.deb


• Debian lighttpd_1.4.19-5+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_alpha.deb

Debian Linux 5.0 mipsel

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb

Debian Linux 4.0 amd64

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_amd64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_amd64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_amd64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_amd64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_amd64.deb


• Debian lighttpd_1.4.13-4etch12_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_amd64.deb

Debian Linux 4.0 ia-32

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_i386.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_i386.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_i386.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_i386.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_i386.deb


• Debian lighttpd_1.4.13-4etch12_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_i386.deb

Debian Linux 4.0 hppa

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_hppa.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_hppa.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_hppa.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_hppa.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_hppa.deb


• Debian lighttpd_1.4.13-4etch12_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_hppa.deb

Debian Linux 4.0 armel

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb

Debian Linux 5.0 armel

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_armel.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_armel.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_armel.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_armel.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_armel.deb


• Debian lighttpd_1.4.19-5+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_armel.deb

Debian Linux 5.0

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb

Debian Linux 4.0 mipsel

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_mipsel.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_mipsel.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_mipsel.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_mipsel.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_mipsel.deb


• Debian lighttpd_1.4.13-4etch12_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_mipsel.deb

Debian Linux 5.0 mips

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_mips.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_mips.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_mips.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_mips.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_mips.deb


• Debian lighttpd_1.4.19-5+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_mips.deb

Debian Linux 4.0 ia-64

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_ia64.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_ia64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_ia64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_ia64.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_ia64.deb


• Debian lighttpd_1.4.13-4etch12_ia64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_ia64.deb

lighttpd lighttpd 1.4.10a

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

Debian Linux 4.0 mips

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb

Debian Linux 5.0 sparc

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_sparc.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_sparc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_sparc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_sparc.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_sparc.deb


• Debian lighttpd_1.4.19-5+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_sparc.deb

Debian Linux 4.0 arm

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_arm.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_arm.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_arm.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_arm.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_arm.deb


• Debian lighttpd_1.4.13-4etch12_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_arm.deb

Debian Linux 4.0 powerpc

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_powerpc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_powerpc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_powerpc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_powerpc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_powerpc.deb


• Debian lighttpd_1.4.13-4etch12_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_powerpc.deb

Debian Linux 4.0 m68k

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb

Debian Linux 5.0 ia-32

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_i386.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_i386.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_i386.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_i386.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_i386.deb


• Debian lighttpd_1.4.19-5+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_i386.deb

Debian Linux 5.0 s/390

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_s390.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_s390.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_s390.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_s390.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_s390.deb


• Debian lighttpd_1.4.19-5+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_s390.deb

Debian Linux 5.0 hppa

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_hppa.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_hppa.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_hppa.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_hppa.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_hppa.deb


• Debian lighttpd_1.4.19-5+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_hppa.deb

Debian Linux 4.0 sparc

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_sparc.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_sparc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_sparc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_sparc.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_sparc.deb


• Debian lighttpd_1.4.13-4etch12_sparc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_sparc.deb

Debian Linux 4.0 s/390

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_s390.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_s390.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_s390.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_s390.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_s390.deb


• Debian lighttpd_1.4.13-4etch12_s390.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_s390.deb

Debian Linux 5.0 m68k

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb

Debian Linux 5.0 arm

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_arm.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_arm.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_arm.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_arm.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_arm.deb


• Debian lighttpd_1.4.19-5+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_arm.deb

Debian Linux 4.0 alpha

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb


• Debian lighttpd-mod-cml_1.4.13-4etch12_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.13-4etch12_alpha.deb


• Debian lighttpd-mod-magnet_1.4.13-4etch12_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.13-4etch12_alpha.deb


• Debian lighttpd-mod-mysql-vhost_1.4.13-4etch12_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.13-4etch12_alpha.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.13-4etch12_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.13-4etch12_alpha.deb


• Debian lighttpd-mod-webdav_1.4.13-4etch12_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.13-4etch12_alpha.deb


• Debian lighttpd_1.4.13-4etch12_alpha.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 3-4etch12_alpha.deb

Debian Linux 4.0

• Debian lighttpd-doc_1.4.13-4etch12_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.13-4etch12_all.deb

Debian Linux 5.0 amd64

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_amd64.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_amd64.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_amd64.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_amd64.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_amd64.deb


• Debian lighttpd_1.4.19-5+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_amd64.deb

Debian Linux 5.0 powerpc

• Debian lighttpd-doc_1.4.19-5+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1 .4.19-5+lenny1_all.deb


• Debian lighttpd-mod-cml_1.4.19-5+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-c ml_1.4.19-5+lenny1_powerpc.deb


• Debian lighttpd-mod-magnet_1.4.19-5+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m agnet_1.4.19-5+lenny1_powerpc.deb


• Debian lighttpd-mod-mysql-vhost_1.4.19-5+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-m ysql-vhost_1.4.19-5+lenny1_powerpc.deb


• Debian lighttpd-mod-trigger-b4-dl_1.4.19-5+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-t rigger-b4-dl_1.4.19-5+lenny1_powerpc.deb


• Debian lighttpd-mod-webdav_1.4.19-5+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-w ebdav_1.4.19-5+lenny1_powerpc.deb


• Debian lighttpd_1.4.19-5+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.1 9-5+lenny1_powerpc.deb

lighttpd lighttpd 1.4

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.1

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.10

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.11

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.12

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.13

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.14

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.15

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.16

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.17

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.18

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.19

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.2

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.20

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.23

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.24

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.25

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.26

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.3

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.4

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.5

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.6

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.7

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.8

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.4.9

• lighttpd lighttpd-1.4.x_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow _request_dos.patch

lighttpd lighttpd 1.5 -pre

• lighttpd lighttpd-1.5_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_r equest_dos.patch

lighttpd lighttpd 1.5

• lighttpd lighttpd-1.5_fix_slow_request_dos.patch
  http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_r equest_dos.patch

lighttpd Slow Request Handling Remote Denial Of Service Vulnerability

References:

• CVE-2010-0295 Vulnerability in lighttpd (Oracle)
  
• lighttpd Home Page (lighttpd)
  
• Multiple vulnerabilities in Lighthttpd (Oracle)
  
• slow request dos/oom attack (lighttpd)
  
• slow request dos/oom attack (lighttpd)