FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-0295

This CVE name corresponds to:

Entered	Topic
2010-02-16	lighttpd -- denial of service vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-0295 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-0295
Phase	Assigned(20100112)

Description

lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.

References

Source	Reference
MLIST	[oss-security] 20100202 lighttpd: slow request dos/oom attack [CVE-2010-0295]
CONFIRM	http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.x_fix_slow_request_dos.patch
CONFIRM	http://download.lighttpd.net/lighttpd/security/lighttpd-1.5_fix_slow_request_dos.patch
CONFIRM	http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt
CONFIRM	http://redmine.lighttpd.net/issues/2147
CONFIRM	http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2710
CONFIRM	http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2711
CONFIRM	http://blogs.sun.com/security/entry/cve_2010_0295_vulnerability_in
DEBIAN	DSA-1987
FEDORA	FEDORA-2010-7611
FEDORA	FEDORA-2010-7636
FEDORA	FEDORA-2010-7643
GENTOO	GLSA-201006-17
SUSE	SUSE-SR:2010:003
BID	38036
SECUNIA	38403
SECUNIA	39765
VUPEN	ADV-2011-0172
XF	lighttpd-slow-request-dos(56038)