CVE-2008-4298

Published: Sep 27, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.

Affected (54)

Products: Lighttpd: Lighttpd

1 product

Configuration A

54 vulnerable

Vulnerable Software	Affected Versions
Lighttpd Lighttpd	Up to 1.4.19
Lighttpd Lighttpd	Version 1.1.1
Lighttpd Lighttpd	Version 1.1.2
Lighttpd Lighttpd	Version 1.1.3
Lighttpd Lighttpd	Version 1.1.4
Lighttpd Lighttpd	Version 1.1.5
Lighttpd Lighttpd	Version 1.1.6
Lighttpd Lighttpd	Version 1.1.7
Lighttpd Lighttpd	Version 1.1.8
Lighttpd Lighttpd	Version 1.1.9
Lighttpd Lighttpd	Version 1.2.1
Lighttpd Lighttpd	Version 1.2.2
Lighttpd Lighttpd	Version 1.2.3
Lighttpd Lighttpd	Version 1.2.4
Lighttpd Lighttpd	Version 1.2.5
Lighttpd Lighttpd	Version 1.2.6
Lighttpd Lighttpd	Version 1.2.7
Lighttpd Lighttpd	Version 1.2.8
Lighttpd Lighttpd	Version 1.3.0
Lighttpd Lighttpd	Version 1.3.10
Lighttpd Lighttpd	Version 1.3.11
Lighttpd Lighttpd	Version 1.3.12
Lighttpd Lighttpd	Version 1.3.13
Lighttpd Lighttpd	Version 1.3.14
Lighttpd Lighttpd	Version 1.3.15
Lighttpd Lighttpd	Version 1.3.16
Lighttpd Lighttpd	Version 1.3.1
Lighttpd Lighttpd	Version 1.3.2
Lighttpd Lighttpd	Version 1.3.3
Lighttpd Lighttpd	Version 1.3.4
Lighttpd Lighttpd	Version 1.3.5
Lighttpd Lighttpd	Version 1.3.6
Lighttpd Lighttpd	Version 1.3.7
Lighttpd Lighttpd	Version 1.3.8
Lighttpd Lighttpd	Version 1.3.9
Lighttpd Lighttpd	Version 1.4.0
Lighttpd Lighttpd	Version 1.4.10
Lighttpd Lighttpd	Version 1.4.11
Lighttpd Lighttpd	Version 1.4.12
Lighttpd Lighttpd	Version 1.4.13
Lighttpd Lighttpd	Version 1.4.14
Lighttpd Lighttpd	Version 1.4.15
Lighttpd Lighttpd	Version 1.4.16
Lighttpd Lighttpd	Version 1.4.17
Lighttpd Lighttpd	Version 1.4.18
Lighttpd Lighttpd	Version 1.4.1
Lighttpd Lighttpd	Version 1.4.2
Lighttpd Lighttpd	Version 1.4.3
Lighttpd Lighttpd	Version 1.4.4
Lighttpd Lighttpd	Version 1.4.5
Lighttpd Lighttpd	Version 1.4.6
Lighttpd Lighttpd	Version 1.4.7
Lighttpd Lighttpd	Version 1.4.8
Lighttpd Lighttpd	Version 1.4.9

Related CWEs

References (38)

http://bugs.gentoo.org/show_bug.cgi?id=238180

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html

Source: cve@mitre.org

http://secunia.com/advisories/32069

Source: cve@mitre.org

http://secunia.com/advisories/32132

Source: cve@mitre.org

http://secunia.com/advisories/32480

Source: cve@mitre.org

http://secunia.com/advisories/32834

Source: cve@mitre.org

http://secunia.com/advisories/32972

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200812-04.xml

Source: cve@mitre.org

http://trac.lighttpd.net/trac/changeset/2305

Source: cve@mitre.org

http://trac.lighttpd.net/trac/ticket/1774

Source: cve@mitre.org

Patch

http://wiki.rpath.com/Advisories:rPSA-2008-0309

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1645

Source: cve@mitre.org

http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/26/5

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/497932/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/31434

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2741

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/45471

Source: cve@mitre.org

http://bugs.gentoo.org/show_bug.cgi?id=238180

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32069

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32132

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32480

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32834

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/32972

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200812-04.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.lighttpd.net/trac/changeset/2305

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.lighttpd.net/trac/ticket/1774

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://wiki.rpath.com/Advisories:rPSA-2008-0309

Source: af854a3a-2127-422b-91ae-364da2661108

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2008/dsa-1645

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/09/26/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/497932/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/31434

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2741

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/45471

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.