38313vdb entry
http://osvdb.org/38313 CVE-2007-3947
Lighttpd 1.4.15 - Multiple Code Execution / Denial of Service / Information Disclosure Vulnerabilities
Record summary
CVE-2007-3947 has a selected CVSS score of 5.8; EIP currently links 1 catalogued exploit.
Description
request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBLighttpd 1.4.15 - Multiple Code Execution / Denial of Service / Information Disclosure VulnerabilitiesExploitDB exploitby Abhisek DattaNot analyzed1 file
References
Showing 12 of 1426130Third-party advisory
http://secunia.com/advisories/26130 26158Third-party advisory
http://secunia.com/advisories/26158 26505Third-party advisory
http://secunia.com/advisories/26505 26593Third-party advisory
http://secunia.com/advisories/26593 GLSA-200708-11Vendor advisory
http://security.gentoo.org/glsa/glsa-200708-11.xml trac.lighttpd.net
http://trac.lighttpd.net/trac/changeset/1869 trac.lighttpd.netConfirmation
http://trac.lighttpd.net/trac/ticket/1232 DSA-1362Vendor advisory
http://www.debian.org/security/2007/dsa-1362 SUSE-SR:2007:015Vendor advisory
http://www.novell.com/linux/security/advisories/2007_15_sr.html 20070719 rPSA-2007-0145-1 lighttpdmailing list
http://www.securityfocus.com/archive/1/474131/100/0/threaded 24967vdb entry
http://www.securityfocus.com/bid/24967