[ GLSA 201006-17 ] lighttpd: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: lighttpd: Denial of Service (GLSA 201006-17)
Severity: normal
Exploitable: remote
Date: June 03, 2010
Bug(s): #303213
ID: 201006-17

Synopsis


A processing error in lighttpd might result in a Denial of Service
condition.


Background


lighttpd is a lightweight high-performance web server.


Affected Packages

Package: www-servers/lighttpd
Vulnerable: < 1.4.25-r1
Unaffected: >= 1.4.25-r1
Architectures: All supported architectures


Description


Li Ming reported that lighttpd does not properly process packets that
are sent overly slow.


Impact


A remote attacker might send specially crafted packets to a server
running lighttpd, possibly resulting in a Denial of Service condition
via host memory exhaustion.


Workaround


There is no known workaround at this time.


Resolution


All lighttpd users should upgrade to the latest version: