CVE-2015-3200 mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NU...
HighCVSS 7.5
EPSS 9.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lighttpd(Debian:12) | < 1.4.37-1 | 1.4.37-1 |
| debian/lighttpd(Debian:13) | < 1.4.37-1 | 1.4.37-1 |
| debian/lighttpd(Debian:14) | < 1.4.37-1 | 1.4.37-1 |
| lighttpd | <= 1.4.35 | No fix listed |
| HP Inc virtual customer access system | <= 15.07 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
References
- Debian Security Tracker CVE-2015-3200 vendor-advisory
- jaanuskp.blogspot.com exploit third-party-advisory
- FEDORA-2015-12252 vendor-advisory
- FEDORA-2015-12250 vendor-advisory
- redmine.lighttpd.net vendor-advisory
- www.oracle.com third-party-advisory
- 74813 vdb-entry
- 1032405 vdb-entry
- h20566.www2.hpe.com vendor-advisory
- kc.mcafee.com
- bugs.debian.org issue-tracking