Home→Descriptions→SA38403
| Secunia ID | |
| CVE-ID | |
| Release Date |
02 Feb 2010 |
| Last Change |
08 Feb 2010 |
| Criticality | |
| Solution Status |
Vendor Patch |
| Software |
lighttpd 1.x |
| Where | |
| Impact |
DoS (Denial of Service)This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system. |
| Description |
A vulnerability has been reported in lighttpd, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to the server allocating several kilobytes of heap memory for each received network packet. This can be exploited to exhaust all available memory and terminate the server via an HTTP session sending e.g. a network packet of 1 byte per second. |
| Solution |
Update to version 1.4.26 or apply patch: |
| Reported by |
Reported by Li Ming in a lighttpd bug report. |
| Original Advisory |
http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt |