Back to search
CVE-2011-4362
Published: Dec 24, 2011
Modified: Aug 7, 2024
PUBLISHED
Description
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
47260
third-party-advisory
x_refsource_SECUNIA
20111224 Lighttpd Proof of Concept code for CVE-2011-4362
mailing-list
x_refsource_BUGTRAQ
[oss-security] 20111129 CVE Request: lighttpd/mod_auth out-of-bounds read due to signedness error
mailing-list
x_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=758624
x_refsource_CONFIRM
DSA-2368
vendor-advisory
x_refsource_DEBIAN
18295
exploit
x_refsource_EXPLOIT-DB
http://blog.pi3.com.pl/?p=277
x_refsource_MISC
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2011_01.txt
x_refsource_CONFIRM
[oss-security] 20111129 Re: CVE Request: lighttpd/mod_auth out-of-bounds read due to signedness error
mailing-list
x_refsource_MLIST
1026359
vdb-entry
x_refsource_SECTRACK
lighttpd-base64-dos(71536)
vdb-entry
x_refsource_XF
http://redmine.lighttpd.net/issues/2370
x_refsource_CONFIRM
JVN#37417423
third-party-advisory
x_refsource_JVN
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now