CVE-2010-0295

Published: Feb 3, 2010Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

Affected (62)

Products: Lighttpd: Lighttpd

1 product

Configuration A

62 vulnerable

Vulnerable Software	Affected Versions
Lighttpd Lighttpd	Up to 1.4.25
Lighttpd Lighttpd	Version 1.0.2
Lighttpd Lighttpd	Version 1.0.3
Lighttpd Lighttpd	Version 1.1.0
Lighttpd Lighttpd	Version 1.1.1
Lighttpd Lighttpd	Version 1.1.2
Lighttpd Lighttpd	Version 1.1.3
Lighttpd Lighttpd	Version 1.1.4
Lighttpd Lighttpd	Version 1.1.5
Lighttpd Lighttpd	Version 1.1.6
Lighttpd Lighttpd	Version 1.1.7
Lighttpd Lighttpd	Version 1.1.8
Lighttpd Lighttpd	Version 1.1.9
Lighttpd Lighttpd	Version 1.2.0
Lighttpd Lighttpd	Version 1.2.1
Lighttpd Lighttpd	Version 1.2.2
Lighttpd Lighttpd	Version 1.2.3
Lighttpd Lighttpd	Version 1.2.5
Lighttpd Lighttpd	Version 1.2.6
Lighttpd Lighttpd	Version 1.2.7
Lighttpd Lighttpd	Version 1.2.8
Lighttpd Lighttpd	Version 1.3.0
Lighttpd Lighttpd	Version 1.3.10
Lighttpd Lighttpd	Version 1.3.11
Lighttpd Lighttpd	Version 1.3.12
Lighttpd Lighttpd	Version 1.3.13
Lighttpd Lighttpd	Version 1.3.14
Lighttpd Lighttpd	Version 1.3.15
Lighttpd Lighttpd	Version 1.3.16
Lighttpd Lighttpd	Version 1.3.1
Lighttpd Lighttpd	Version 1.3.2
Lighttpd Lighttpd	Version 1.3.3
Lighttpd Lighttpd	Version 1.3.4
Lighttpd Lighttpd	Version 1.3.5
Lighttpd Lighttpd	Version 1.3.6
Lighttpd Lighttpd	Version 1.3.8
Lighttpd Lighttpd	Version 1.3.9
Lighttpd Lighttpd	Version 1.4.0
Lighttpd Lighttpd	Version 1.4.10
Lighttpd Lighttpd	Version 1.4.11
Lighttpd Lighttpd	Version 1.4.12
Lighttpd Lighttpd	Version 1.4.13
Lighttpd Lighttpd	Version 1.4.14
Lighttpd Lighttpd	Version 1.4.15
Lighttpd Lighttpd	Version 1.4.16
Lighttpd Lighttpd	Version 1.4.17
Lighttpd Lighttpd	Version 1.4.18
Lighttpd Lighttpd	Version 1.4.19
Lighttpd Lighttpd	Version 1.4.20
Lighttpd Lighttpd	Version 1.4.21
Lighttpd Lighttpd	Version 1.4.22
Lighttpd Lighttpd	Version 1.4.23
Lighttpd Lighttpd	Version 1.4.24
Lighttpd Lighttpd	Version 1.4.2
Lighttpd Lighttpd	Version 1.4.3
Lighttpd Lighttpd	Version 1.4.4
Lighttpd Lighttpd	Version 1.4.5
Lighttpd Lighttpd	Version 1.4.6
Lighttpd Lighttpd	Version 1.4.7
Lighttpd Lighttpd	Version 1.4.8
Lighttpd Lighttpd	Version 1.4.9
Lighttpd Lighttpd	Version 1.5.0

Related CWEs

References (38)

http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in

Source: secalert@redhat.com

http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch

Source: secalert@redhat.com

Patch

http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch

Source: secalert@redhat.com

Patch

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041264.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041296.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041307.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html

Source: secalert@redhat.com

http://redmine.lighttpd.net/issues/2147

Source: secalert@redhat.com

http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2710

Source: secalert@redhat.com

http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711

Source: secalert@redhat.com

http://secunia.com/advisories/38403

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/39765

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201006-17.xml

Source: secalert@redhat.com

http://www.debian.org/security/2010/dsa-1987

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/02/01/8

Source: secalert@redhat.com

http://www.securityfocus.com/bid/38036

Source: secalert@redhat.com

ExploitPatch

http://www.vupen.com/english/advisories/2011/0172

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/56038

Source: secalert@redhat.com

http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in

Source: af854a3a-2127-422b-91ae-364da2661108

http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041264.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041296.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041307.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://redmine.lighttpd.net/issues/2147

Source: af854a3a-2127-422b-91ae-364da2661108

http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2710

Source: af854a3a-2127-422b-91ae-364da2661108

http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38403

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/39765

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-201006-17.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2010/dsa-1987

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/02/01/8

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/38036

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.vupen.com/english/advisories/2011/0172

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/56038

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.