CVE-2011-4362: Medium severity fipsasp fipscms light vulnerability
An signedness error, leading to out of stack-based buffer read flaw was found in the way lighttpd, a lightning fast webserver with light system requirements, processed certain invalid base64 HTTP authentication tokens. A remote attacker could provide a specially crafted HTTP authentication request, leading to denial of service (lighttpd daemon crash due to an signedness error while processing the token).
Upstream bug report: [1] http://redmine.lighttpd.net/issues/2370
Upstream patch (with testcase and NEWS update): [2] http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2806/diff
References: [3] http://download.lighttpd.net/lighttpd/security/lighttpdsa201101.txt (upstream advisory) [4] http://www.openwall.com/lists/oss-security/2011/11/29/8 (CVE request) [5] http://www.openwall.com/lists/oss-security/2011/11/29/13 (CVE assignment)
Other sources
Integer signedness error in the base64decode function in the HTTP authentication functionality (httpauth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4362?
CVE-2011-4362 is classified as a medium severity vulnerability due to the potential for remote exploitation.
How do I fix CVE-2011-4362?
To fix CVE-2011-4362, upgrade lighttpd to version 1.5.1 or later, or apply relevant patches provided by your distribution.
What effect does CVE-2011-4362 have on affected systems?
CVE-2011-4362 can lead to stack-based buffer reading, potentially allowing attackers to access sensitive information.
Which versions of lighttpd are affected by CVE-2011-4362?
CVE-2011-4362 affects lighttpd versions from 1.4.1 to 1.4.30 and 1.5.0.
Can CVE-2011-4362 be exploited remotely?
Yes, remote attackers can exploit CVE-2011-4362 by sending specially crafted HTTP authentication requests.