| VID |
22830 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
WWW |
| Detailed Description |
The Web server is running a version of lighttpd which is older than 1.4.20. lighttpd is a web server that provides an interface to external programs and allows Web applications to run separate chroot.
According to its banner, the version of lighttpd running on the remote host is prior to 1.4.36. It is, therefore, affected by the following vulnerabilities :
- mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
* Note: This check solely relied on the banner of the remote Web server to assess this vulnerability, so this might be a false positive.
* References:
https://jaanuskp.blogspot.in/2015/05/cve-2015-3200.html
https://www.lighttpd.net/2015/7/26/1.4.36/
* Platforms Affected:
lighttpd versions prior to 1.4.36
Any operating system Any version |
| Recommendation |
Upgrade to the latest version of lighttpd (1.4.36 or later), available from the lighttpd Download Web site at http://lighttpd.net/download/ |
| Related URL |
CVE-2015-3200 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
