CVE-2010-0295

Lighttpd < 1.4.25 - Resource Management Error

Title source: rule

Description

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Li Ming · bashdoslinux

https://www.exploit-db.com/exploits/33591

View Code ZIP pw:eip

References (19)

[Various Sources] http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711

[Various Sources] http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in

[Patch] http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch

[Patch] http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch

[Patch] http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html

[Various Sources] http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2710

[Vendor Advisory] http://secunia.com/advisories/38403

[Third Party Advisory] http://secunia.com/advisories/39765

[Exploit, Patch] http://www.securityfocus.com/bid/38036

[Third Party Advisory] http://www.vupen.com/english/advisories/2011/0172

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/56038

[Issue Tracking] http://redmine.lighttpd.net/issues/2147

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041264.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041296.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041307.html

[Third Party Advisory] http://www.debian.org/security/2010/dsa-1987

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-201006-17.xml

[Mailing List] http://www.openwall.com/lists/oss-security/2010/02/01/8

Scores

EPSS 0.0556

EPSS Percentile 90.3%

Details

CWE

CWE-399

Status published

Products (50)

lighttpd/lighttpd 1.0.2

lighttpd/lighttpd 1.0.3

lighttpd/lighttpd 1.1.0

lighttpd/lighttpd 1.1.1

lighttpd/lighttpd 1.1.2

lighttpd/lighttpd 1.1.3

lighttpd/lighttpd 1.1.4

lighttpd/lighttpd 1.1.5

lighttpd/lighttpd 1.1.6

lighttpd/lighttpd 1.1.7

... and 40 more

Published Feb 03, 2010

Tracked Since Feb 18, 2026