Lighttpd 'http_auth.c' Security Bypass Vulnerability

Bugtraq ID:	74813
Class:	Access Validation Error
CVE:	CVE-2015-3200
Remote:	Yes
Local:	No
Published:	May 25 2015 12:00AM
Updated:	Aug 30 2016 08:00AM
Credit:	Jaanus
Vulnerable:	lighttpd lighttpd 0 IBM PowerKVM 2.1 IBM Integrated Management Module YUOOG9A-1.49 HP Virtual Customer Access System (vCAS) 15.07 HP Virtual Customer Access System (vCAS) 14.06
Not Vulnerable:	IBM PowerKVM 2.1.1 SP3 IBM PowerKVM 2.1.1 Build 65.1 IBM Integrated Management Module YUOOH1C-1.50 HP Virtual Customer Access System (vCAS) 16.05

Lighttpd 'http_auth.c' Security Bypass Vulnerability

Lighttpd is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

Lighttpd 'http_auth.c' Security Bypass Vulnerability

An attacker can exploit this issue using a readily available tools.

Lighttpd 'http_auth.c' Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Lighttpd 'http_auth.c' Security Bypass Vulnerability

References:

• lighttpd Home Page (lighttpd)
  
• Lighttpd Log Injection - CVE-2015-3200 (Jaanuskp)
  
• HPSBGN03638 rev.1 - HPE Remote Device Access Vulnerabilities (HP)
  
• IBM Advisory isg3T1022837 (IBM)
  
• MIGR-5099226:Vulnerability in lighttpd affects IBM Integrated Management Module (IBM)