lighttpd SSL Weak Cipher CVE-2013-4508 Security Bypass Weakness
BID:63534
Info
lighttpd SSL Weak Cipher CVE-2013-4508 Security Bypass Weakness
| Bugtraq ID: | 63534 |
| Class: | Design Error |
| CVE: |
CVE-2013-4508 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 01 2013 12:00AM |
| Updated: | Apr 13 2015 09:55PM |
| Credit: | Nathan Bishop |
| Vulnerable: |
lighttpd lighttpd 1.4.30 lighttpd lighttpd 1.4.26 lighttpd lighttpd 1.4.25 lighttpd lighttpd 1.4.24 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
lighttpd SSL Weak Cipher CVE-2013-4508 Security Bypass Weakness
lighttpd is prone to a security-bypass weakness.
Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks.
lighttpd 1.4.24 through 1.4.33 are vulnerable; other versions may also be affected.
lighttpd is prone to a security-bypass weakness.
Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks.
lighttpd 1.4.24 through 1.4.33 are vulnerable; other versions may also be affected.
Exploit / POC
lighttpd SSL Weak Cipher CVE-2013-4508 Security Bypass Weakness
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
lighttpd SSL Weak Cipher CVE-2013-4508 Security Bypass Weakness
Solution:
Updates are available. Please see the references for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references for more information.
Mandriva Business Server 1 X86 64
-
Mandriva lighttpd-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_auth-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_cml-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_compress-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_magnet-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_mysql_vhost-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_trigger_b4_dl-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lighttpd-mod_webdav-1.4.30-6.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/
References
lighttpd SSL Weak Cipher CVE-2013-4508 Security Bypass Weakness
References:
References:
- Bug 1026566 - (CVE-2013-4508) CVE-2013-4508 lighttpd: uses vulnerable cipher sui (Red Hat)
- lighttpd Homepage (lighttpd)
- ssl.cipher-list not inherited into SNI (lighttpd)
- Using possibly vulnerable cipher suites with SNI (lighttpd)
- HPSBGN03191 rev.1 - HP Remote Device Access: Virtual Customer Access System (vCA (HP)