CVE-2010-0295

Severity

50%

Complexity

99%

Confidentiality

48%

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P).

Overview

Type

lighttpd

First reported 15 years ago

2010-02-03 19:30:00

Last updated 7 years ago

2017-08-17 01:31:00

Affected Software

lighttpd 1.3.11

1.3.11

lighttpd 1.3.12

1.3.12

lighttpd 1.3.13

1.3.13

lighttpd 1.3.14

1.3.14

lighttpd 1.3.15

1.3.15

lighttpd 1.3.16

1.3.16

lighttpd 1.4.2

1.4.2

lighttpd 1.4.3

1.4.3

lighttpd 1.4.4

1.4.4

lighttpd 1.4.5

1.4.5

lighttpd 1.4.6

1.4.6

lighttpd 1.4.7

1.4.7

lighttpd 1.4.8

1.4.8

lighttpd 1.4.9

1.4.9

lighttpd 1.4.10

1.4.10

lighttpd 1.4.11

1.4.11

lighttpd 1.4.12

1.4.12

lighttpd 1.4.13

1.4.13

lighttpd lighttpd 1.4.14

1.4.14

lighttpd 1.4.15

1.4.15

lighttpd 1.4.16

1.4.16

lighttpd lighttpd 1.4.17

1.4.17

lighttpd 1.4.18

1.4.18

lighttpd lighttpd 1.4.19

1.4.19

lighttpd lighttpd 1.4.20

1.4.20

lighttpd lighttpd 1.4.21

1.4.21

lighttpd lighttpd 1.4.22

1.4.22

lighttpd lighttpd 1.4.23

1.4.23

lighttpd lighttpd 1.4.24

1.4.24

lighttpd 1.5.0

1.5.0

References

http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt

http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch

http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch

FEDORA-2010-7636

FEDORA-2010-7611

FEDORA-2010-7643

SUSE-SR:2010:003

http://redmine.lighttpd.net/issues/2147

http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2710

http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711

38403

Vendor Advisory

39765

GLSA-201006-17

DSA-1987

[oss-security] 20100202 lighttpd: slow request dos/oom attack [CVE-2010-0295]

38036

ADV-2011-0172

lighttpd-slow-request-dos(56038)

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.