Date: Fri, 20 Apr 2007 15:46:13 -0400
From: Foresight Linux Essential Announcement Service <foresight-security-noreply@foresightlinux.org.>
To: foresight-security-announce@lists.rpath.org
Subject: FLEA-2007-0011-1: lighttpd
References: <45EF374E.1090207@foresightlinux.org.> <45EF8D85.3050102@moritz-naumann.com.>
In-Reply-To: <45EF8D85.3050102@moritz-naumann.com.>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
Foresight Linux Essential Advisory: 2007-0011-1
Published: 2007-04-20
Rating: Moderate
Updated Versions:
lighttpd=/conary.rpath.com@rpl:devel//1/1.4.15-0.1-1
group-dist=/foresight.rpath.org@fl:1-devel//1/1.2.1-0.1-3
References:
https://issues.rpath.com/browse/RPL-1218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1869http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1870
Description:
Previous versions of the lighttpd package are vulnerable to two denial of
service attacks. One is a remote denial of service that can cause lighttpd to
consume all available CPU time and stop serving requests, and the other is a
denial of service attack which generally requires a local user to create a file
with an mtime of 0; the lighttpd daemon will crash when attempting to serve that
file. This crash does not enable any arbitrary or directed code execution;
however, since the rAA service (Foresight System Manager) uses lighttpd by
default, and rAA is configured to start by default, all Foresight systems are
vulnerable to this DoS by default. Once lighttpd has been crashed or made to
stop serving requests, subsequent updates using the Foresight System Manager
(rAA) will not occur.
