Vulnerabilities > CVE-2008-0983 - Resource Management Errors vulnerability in Lighttpd

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-1609. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(33507);
  script_version("1.12");
  script_cvs_date("Date: 2019/08/02 13:32:21");

  script_cve_id("CVE-2007-3948", "CVE-2008-0983");
  script_xref(name:"DSA", value:"1609");

  script_name(english:"Debian DSA-1609-1 : lighttpd - various");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several local/remote vulnerabilities have been discovered in lighttpd,
a fast webserver with minimal memory footprint.

The Common Vulnerabilities and Exposures project identifies the
following problems :

  - CVE-2008-0983
    lighttpd 1.4.18, and possibly other versions before
    1.5.0, does not properly calculate the size of a file
    descriptor array, which allows remote attackers to cause
    a denial of service (crash) via a large number of
    connections, which triggers an out-of-bounds access. 

  - CVE-2007-3948
    connections.c in lighttpd before 1.4.16 might accept
    more connections than the configured maximum, which
    allows remote attackers to cause a denial of service
    (failed assertion) via a large number of connection
    attempts."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=434888"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466663"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-0983"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2007-3948"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2008/dsa-1609"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the lighttpd package.

For the stable distribution (etch), these problems have been fixed in
version 1.4.13-4etch9."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_cwe_id(399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:lighttpd");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/07/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/07/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"4.0", prefix:"lighttpd", reference:"1.4.13-4etch9")) flag++;
if (deb_check(release:"4.0", prefix:"lighttpd-doc", reference:"1.4.13-4etch9")) flag++;
if (deb_check(release:"4.0", prefix:"lighttpd-mod-cml", reference:"1.4.13-4etch9")) flag++;
if (deb_check(release:"4.0", prefix:"lighttpd-mod-magnet", reference:"1.4.13-4etch9")) flag++;
if (deb_check(release:"4.0", prefix:"lighttpd-mod-mysql-vhost", reference:"1.4.13-4etch9")) flag++;
if (deb_check(release:"4.0", prefix:"lighttpd-mod-trigger-b4-dl", reference:"1.4.13-4etch9")) flag++;
if (deb_check(release:"4.0", prefix:"lighttpd-mod-webdav", reference:"1.4.13-4etch9")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update lighttpd-5107.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(31775);
  script_version ("1.10");
  script_cvs_date("Date: 2019/10/25 13:36:32");

  script_cve_id("CVE-2008-0983", "CVE-2008-1111", "CVE-2008-1270");

  script_name(english:"openSUSE 10 Security Update : lighttpd (lighttpd-5107)");
  script_summary(english:"Check for the lighttpd-5107 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - Remote attackers were able to crash lighttpd by opening
    a large number of connections (CVE-2008-0983).

  - A bug in mod_cgi allowed remote attackers to read cgi
    source files (CVE-2008-1111).

  - A bug in mod_userdir allowed remote attackers to read
    arbitrary files (CVE-2008-1270)."
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected lighttpd packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_cwe_id(200, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd-mod_cml");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd-mod_magnet");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd-mod_mysql_vhost");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd-mod_rrdtool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd-mod_trigger_b4_dl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:lighttpd-mod_webdav");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/04/04");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.1|SUSE10\.2|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.1 / 10.2 / 10.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.1", reference:"lighttpd-1.4.10-11.20") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"lighttpd-mod_cml-1.4.10-11.20") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"lighttpd-mod_mysql_vhost-1.4.10-11.20") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"lighttpd-mod_rrdtool-1.4.10-11.20") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"lighttpd-mod_trigger_b4_dl-1.4.10-11.20") ) flag++;
if ( rpm_check(release:"SUSE10.1", reference:"lighttpd-mod_webdav-1.4.10-11.20") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-mod_cml-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-mod_magnet-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-mod_mysql_vhost-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-mod_rrdtool-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-mod_trigger_b4_dl-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.2", reference:"lighttpd-mod_webdav-1.4.13-41.8") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-1.4.18-1.3") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-mod_cml-1.4.18-1.3") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-mod_magnet-1.4.18-1.3") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-mod_mysql_vhost-1.4.18-1.3") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-mod_rrdtool-1.4.18-1.3") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-mod_trigger_b4_dl-1.4.18-1.3") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"lighttpd-mod_webdav-1.4.18-1.3") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "lighttpd / lighttpd-mod_cml / lighttpd-mod_mysql_vhost / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2008-2278.
#

include("compat.inc");

if (description)
{
  script_id(31372);
  script_version ("1.18");
  script_cvs_date("Date: 2019/08/02 13:32:27");

  script_cve_id("CVE-2008-0983", "CVE-2008-1111");
  script_bugtraq_id(27943, 28100);
  script_xref(name:"FEDORA", value:"2008-2278");

  script_name(english:"Fedora 8 : lighttpd-1.4.18-6.fc8 (2008-2278)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - Tue Mar 4 2008 Matthias Saou <http://freshrpms.net/>
    1.4.18-6

    - Include patch for CVE-2008-0983 (crash when low on
      file descriptors).

    - Include patch for CVE-2008-1111 (cgi source
      disclosure).

    - Tue Feb 19 2008 Fedora Release Engineering <rel-eng at
      fedoraproject.org>

    - Autorebuild for GCC 4.3

    - Wed Dec 5 2007 Release Engineering <rel-eng at
      fedoraproject dot org>

    - Rebuild for deps

    - Wed Oct 31 2007 Matthias Saou <http://freshrpms.net/>
      1.4.18-3

    - Update mod_geoip source to fix segfault upon stopping
      lighttpd.

    - Mon Oct 22 2007 Matthias Saou <http://freshrpms.net/>
      1.4.18-2

    - Include mod_geoip additional source, make it an
      optional sub-package.

    - Reorder sub-packages alphabetically in spec file.

    - Make sub-packages require exact release, just in case.

    - Change default webroot back from /srv to /var.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://freshrpms.net/
  script_set_attribute(
    attribute:"see_also",
    value:"https://freshrpms.net/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=434163"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=435805"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2008-March/008519.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?2505a483"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected lighttpd package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(200, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:lighttpd");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:8");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/07");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 8.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC8", reference:"lighttpd-1.4.18-6.fc8")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "lighttpd");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(106624);
  script_version("$Revision: 1.2 $");
  script_cvs_date("$Date: 2018/02/07 15:00:36 $");

  script_cve_id(
    "CVE-2008-1270",
    "CVE-2008-1111",
    "CVE-2008-0983");
  script_bugtraq_id(
    28226,
    28100,
    27943);

  script_name(english:"lighttpd < 1.4.19 Multiple Vulnerabilities");
  script_summary(english:"Checks version in Server response header.");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of lighttpd running on the remote
host is prior to 1.4.19. Therefore, it may be, affected by the following
vulnerabilities :

  - lighttpd does not properly calculate the size of a file descriptor
    array, which allows remote attackers to cause a denial of service
    (crash) via a large number of connections, which triggers an
    out-of-bounds access.

  - lighttpd sends the source code of CGI scripts instead of a 500
    error when a fork failure occurs, which might allow remote
    attackers to obtain sensitive information.

  - When userdir.path is not set, uses a default of $HOME, which
    might allow remote attackers to read arbitrary files.

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"solution", value:
"Upgrade to lighttpd version 1.4.19. Alternatively, apply the
vendor-supplied patch.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(200, 399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/02/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:lighttpd:lighttpd");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");
  script_copyright(english:"This script is Copyright (C) 2018 Tenable Network Security, Inc.");

  script_dependencies("lighttpd_detect.nasl");
  script_require_keys("installed_sw/lighttpd", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80);
  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("vcf.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

appname = "lighttpd";
get_install_count(app_name:appname, exit_if_zero:TRUE);
port = get_http_port(default:80);
app_info = vcf::get_app_info(app:appname, port:port, webapp:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [{"fixed_version":"1.4.19"}];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);