CVE-2007-3946: Medium severity Lighttpd Lighttpd vulnerability
modauth (httpauth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3946?
CVE-2007-3946 has been classified as a denial of service vulnerability with a potential impact of causing the lighttpd daemon to crash.
How do I fix CVE-2007-3946?
To fix CVE-2007-3946, upgrade to lighttpd version 1.4.16 or later, which addresses this vulnerability.
Which versions of lighttpd are affected by CVE-2007-3946?
CVE-2007-3946 affects lighttpd versions prior to 1.4.16, specifically all versions up to and including 1.4.15.
What are the potential attack vectors for CVE-2007-3946?
The potential attack vectors for CVE-2007-3946 include memory leaks, incorrect handling of md5-sess without a cnonce, and issues with base64 encoded strings and trailing whitespace in the Auth-Digest header.
Is CVE-2007-3946 a known issue in lighttpd?
Yes, CVE-2007-3946 is a recognized issue in lighttpd that has been documented and addressed in subsequent software updates.