fkie_cve-2008-0983
Vulnerability from fkie_nvd
Published
2008-02-26 18:44
Modified
2025-04-09 00:30
Severity ?
Summary
lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.
References
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
cve@mitre.orghttp://secunia.com/advisories/29066Patch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/29166
cve@mitre.orghttp://secunia.com/advisories/29209
cve@mitre.orghttp://secunia.com/advisories/29268
cve@mitre.orghttp://secunia.com/advisories/29622
cve@mitre.orghttp://secunia.com/advisories/31104
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200803-10.xml
cve@mitre.orghttp://trac.lighttpd.net/trac/ticket/1562Patch
cve@mitre.orghttp://wiki.rpath.com/Advisories:rPSA-2008-0084
cve@mitre.orghttp://www.debian.org/security/2008/dsa-1609
cve@mitre.orghttp://www.securityfocus.com/archive/1/488926/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/27943Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0659/references
cve@mitre.orghttps://issues.rpath.com/browse/RPL-2284
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29066Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29166
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29209
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29268
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29622
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/31104
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200803-10.xml
af854a3a-2127-422b-91ae-364da2661108http://trac.lighttpd.net/trac/ticket/1562Patch
af854a3a-2127-422b-91ae-364da2661108http://wiki.rpath.com/Advisories:rPSA-2008-0084
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2008/dsa-1609
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/488926/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/27943Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0659/references
af854a3a-2127-422b-91ae-364da2661108https://issues.rpath.com/browse/RPL-2284
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html
Impacted products
Vendor Product Version
lighttpd lighttpd 1.4.7
lighttpd lighttpd 1.4.8
lighttpd lighttpd 1.4.9
lighttpd lighttpd 1.4.10
lighttpd lighttpd 1.4.11
lighttpd lighttpd 1.4.12
lighttpd lighttpd 1.4.13
lighttpd lighttpd 1.4.14
lighttpd lighttpd 1.4.15
lighttpd lighttpd 1.4.16
lighttpd lighttpd 1.4.17
lighttpd lighttpd 1.4.18


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4F8F89B-5A10-4EE3-A035-1CEA44B1691A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "F89FCD49-0C73-4E73-9D99-38700B622A06",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFA9AF51-F423-4167-88AB-5BF916BCC273",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A21B3F82-1C1D-46EE-92EF-46F7F590957E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "482312DE-D483-42EC-B8B3-C71CE088C7B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5549E74-A7A7-4D99-B08B-C6ACFB3917FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "72ABD4D8-8AD9-45E5-8FF5-FA947AC07F49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EC04CE1-4C31-42B7-A92D-38393F549014",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "F79EED03-A95B-4636-A0AA-1F9E72DEF930",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "176D53A7-A81C-4C1F-A7B8-90604A9545F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "8372FF7B-CF9B-4963-AB53-704E87AF3540",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:lighttpd:lighttpd:1.4.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA46E89A-565E-439D-BCB2-6CEE44EFDFAC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access."
    },
    {
      "lang": "es",
      "value": "lighttpd 1.4.18 y posiblemente otras versiones anteriores a la 1.5.0, no calcula correctamente el tama\u00f1o del array descriptor de archivos, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) a trav\u00e9s de un gran n\u00famero de conexiones, lo cual dispara un acceso fuera de l\u00edmite."
    }
  ],
  "id": "CVE-2008-0983",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-02-26T18:44:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29066"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29166"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29209"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29268"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29622"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/31104"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200803-10.xml"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://trac.lighttpd.net/trac/ticket/1562"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0084"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2008/dsa-1609"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/488926/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/27943"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0659/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://issues.rpath.com/browse/RPL-2284"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29066"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29166"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29209"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29622"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/31104"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200803-10.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://trac.lighttpd.net/trac/ticket/1562"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0084"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2008/dsa-1609"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/488926/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/27943"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0659/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.rpath.com/browse/RPL-2284"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00162.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00180.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.