CVE-2008-1531
Debian Linux Security Advisory 1540-2
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.
La función connection_state_machine (connections.c) en lighttpd versión 1.4.19 y anteriores, y versión 1.5.x anterior a 1.5.0, permite a los atacantes remotos generar una denegación de servicio (pérdida de conexión SSL activa) al activar un error SSL, como desconectarse antes que una descarga ha finalizado, lo que hace que todas las conexiones SSL activas se pierdan.
Julien Cayzax discovered that an insecure default setting exists in mod_userdir in lighttpd. When userdir.path is not set the default value used is $HOME. It should be noted that the nobody user's $HOME is / (CVE-2008-1270). An error also exists in the SSL connection code which can be triggered when a user prematurely terminates his connection (CVE-2008-1531). Versions less than 1.4.19-r2 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2008-03-27 CVE Reserved
- 2008-03-27 CVE Published
- 2024-08-07 CVE Updated
- 2025-05-28 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (23)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/29505 | Third Party Advisory | |
| http://secunia.com/advisories/29544 | Third Party Advisory | |
| http://secunia.com/advisories/29636 | Third Party Advisory | |
| http://secunia.com/advisories/29649 | Third Party Advisory | |
| http://secunia.com/advisories/30023 | Third Party Advisory | |
| http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0132 | Third Party Advisory | |
| http://www.osvdb.org/43788 | Broken Link | |
| http://www.securityfocus.com/archive/1/490323/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/28489 | Third Party Advisory | |
| http://www.vupen.com/english/advisories/2008/1063/references | Third Party Advisory | |
| https://bugs.gentoo.org/show_bug.cgi?id=214892 | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/41545 | Third Party Advisory | |
| https://issues.rpath.com/browse/RPL-2407 | Broken Link |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Lighttpd Search vendor "Lighttpd" | Lighttpd Search vendor "Lighttpd" for product "Lighttpd" | <= 1.4.19 Search vendor "Lighttpd" for product "Lighttpd" and version " <= 1.4.19" | - |
Affected
| ||||||
| Lighttpd Search vendor "Lighttpd" | Lighttpd Search vendor "Lighttpd" for product "Lighttpd" | >= 1.5 < 1.5.0 Search vendor "Lighttpd" for product "Lighttpd" and version " >= 1.5 < 1.5.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0" | - |
Affected
| ||||||