CVE-2012-5533
lighttpd 1.4.31 - Denial of Service (PoC)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header.
La función http_request_split_value en request.c en lighttpd en versiones anteriores a 1.4.32 permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de una petición con una cabecera que contiene un token vacío, tal como se demuestra utilizando la cabecera "Connection: TE,,Keep-Alive".
A potential security vulnerabilities have been identified with HP Remote Device Access: Virtual Customer Access System (vCAS) running lighttpd. These vulnerabilities could be exploited remotely resulting in disclosure of information, elevation of privilege, SQL injection, or to create a Denial of Service (DoS). These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. SSLv3 is enabled by default in the lighttpd based vCAS Web Server. Revision 1 of this advisory.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-10-24 CVE Reserved
- 2012-11-22 First Exploit
- 2012-11-24 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-399: Resource Management Errors
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/87623 | Vdb Entry | |
| http://packetstormsecurity.org/files/118282/Simple-Lighttpd-1.4.31-Denial-Of-Service.html | X_refsource_misc | |
| http://www.openwall.com/lists/oss-security/2012/11/21/1 | Mailing List |
|
| http://www.securitytracker.com/id?1027802 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/80213 | Vdb Entry | |
| https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0345 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/22902 | 2012-11-22 | |
| http://www.exploit-db.com/exploits/22902 | 2024-08-06 | |
| http://www.securityfocus.com/bid/56619 | 2024-08-06 |
| URL | Date | SRC |
|---|---|---|
| http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.31_fix_connection_header_dos.patch | 2017-08-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Lighttpd Search vendor "Lighttpd" | Lighttpd Search vendor "Lighttpd" for product "Lighttpd" | 1.4.31 Search vendor "Lighttpd" for product "Lighttpd" and version "1.4.31" | - |
Affected
| ||||||
| Lighttpd Search vendor "Lighttpd" | Lighttpd Search vendor "Lighttpd" for product "Lighttpd" | 1.4.32 Search vendor "Lighttpd" for product "Lighttpd" and version "1.4.32" | - |
Affected
| ||||||