Debian Bug report logs - #466663
lighttpd: remote denial of service

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: u0@desibbrg.com

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: fdevent.c.171: aborted

Date: Wed, 20 Feb 2008 09:38:44 +0100

Package: lighttpd
Version: 1.4.13-4etch4
Severity: important

Hi,

Lighttpd crashed with this strace:
ioctl(982, FIONREAD, [0])               = 0
read(982, 0x8649ed0, 1471)              = -1 EAGAIN (Resource temporarily unavailable)
time(NULL)                              = 1203496074
poll([{fd=4, events=POLLIN}, {fd=6, events=POLLOUT}, {fd=7, events=POLLOUT}, {fd=8, events=POLLOUT}, {fd=9, events=POLLOUT}, {fd=10, events=POLLOUT}, {fd=16, events=POLLOUT}, {fd=18, events=POLLOUT}, {fd=20, events=POLLOUT}, {fd=22, events=POLLOUT}, {fd=24, 
events=POLLOUT}, {fd=26, events=POLLOUT}, {fd=28, events=POLLOUT}, {fd=30, events=POLLOUT}, {fd=32, events=POLLOUT}, {fd=34, events=POLLOUT}, {fd=36, events=POLLOUT}, {fd=38, events=POLLOUT}, {fd=40, events=POLLOUT}, {fd=41, events=POLLOUT}, {fd=44, 
events=POLLOUT}, {fd=46, events=POLLOUT}, {fd=48, events=POLLOUT}, {fd=50, events=POLLOUT}, {fd=52, events=POLLOUT}, {fd=190, events=POLLOUT}, {fd=56, events=POLLOUT}, {fd=124, events=POLLOUT}, {fd=58, events=POLLOUT}, {fd=60, events=POLLOUT}, {fd=62, 
events=POLLOUT}, {fd=64, events=POLLOUT}, ...], 530, 1000) = 1
write(2, "fdevent.c.171: aborted\n", 23) = 23
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
tgkill(19774, 19774, SIGABRT)           = 0
--- SIGABRT (Aborted) @ 0 (0) ---
Process 19774 detached

It looks familiar, I think this has been fixed upstream.

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable'), (1, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-6-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages lighttpd depends on:
ii  libattr1               2.4.32-1          Extended attribute shared library
ii  libbz2-1.0             1.0.3-6           high-quality block-sorting file co
ii  libc6                  2.3.6.ds1-13etch5 GNU C Library: Shared libraries
ii  libldap2               2.1.30-13.3       OpenLDAP libraries
ii  libpcre3               6.7+7.4-3         Perl 5 Compatible Regular Expressi
ii  libssl0.9.8            0.9.8c-4etch1     SSL shared libraries
ii  lsb-base               3.1-23.2etch1     Linux Standard Base 3.1 init scrip
ii  mime-support           3.39-1            MIME files 'mime.types' & 'mailcap
ii  zlib1g                 1:1.2.3-13        compression library - runtime

Versions of packages lighttpd recommends:
ii  php5-cgi                  5.2.0-8+etch10 server-side, HTML-embedded scripti

-- no debconf information

Message #12 received at 466663@bugs.debian.org (full text, mbox, reply):

From: Olaf van der Spek <OlafvdSpek@GMail.Com>

To: Debian Bug Tracking System <466663@bugs.debian.org>

Subject: lighttpd: 1.4.18 is also affected

Date: Thu, 21 Feb 2008 20:53:23 +0100

Package: lighttpd
Version: 1.4.18-1
Followup-For: Bug #466663

Hi,

1.4.18 is also affected and this bug is remotely exploitable, causing a crash (DoS).

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable'), (1, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-6-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages lighttpd depends on:
ii  libattr1               2.4.32-1          Extended attribute shared library
ii  libbz2-1.0             1.0.3-6           high-quality block-sorting file co
ii  libc6                  2.3.6.ds1-13etch5 GNU C Library: Shared libraries
ii  libfam0                2.7.0-12          Client library to control the FAM 
ii  libldap2               2.1.30-13.3       OpenLDAP libraries
ii  libpcre3               6.7+7.4-3         Perl 5 Compatible Regular Expressi
ii  libssl0.9.8            0.9.8c-4etch1     SSL shared libraries
ii  libterm-readline-perl- 1.0302-1          Perl implementation of Readline li
ii  lsb-base               3.1-23.2etch1     Linux Standard Base 3.1 init scrip
ii  mime-support           3.39-1            MIME files 'mime.types' & 'mailcap
ii  zlib1g                 1:1.2.3-13        compression library - runtime

lighttpd recommends no packages.

-- no debconf information

Message #21 received at 466663@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 466663@bugs.debian.org

Cc: control@bugs.debian.org

Subject: lighttpd remote DoS

Date: Mon, 25 Feb 2008 12:47:43 +0100

[Message part 1 (text/plain, inline)]

tags 466663 + patch
thanks

Is anyone working on an updated package?
There is a patch on:
http://trac.lighttpd.net/trac/attachment/ticket/1562/Fix-372-and-1562.patch

and I'd prepare an NMU otherwise.
Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #32 received at 466663@bugs.debian.org (full text, mbox, reply):

From: Pierre Habouzit <madcoder@debian.org>

To: Nico Golde <nion@debian.org>, 466663@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#466663: lighttpd remote DoS

Date: Mon, 25 Feb 2008 13:51:25 +0100

[Message part 1 (text/plain, inline)]

On Mon, Feb 25, 2008 at 11:47:43AM +0000, Nico Golde wrote:
> tags 466663 + patch
> thanks
> 
> Is anyone working on an updated package?
> There is a patch on:
> http://trac.lighttpd.net/trac/attachment/ticket/1562/Fix-372-and-1562.patch

  I will today or tomorrow for unstable.


-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org

[Message part 2 (application/pgp-signature, inline)]

Message #37 received at 466663-close@bugs.debian.org (full text, mbox, reply):

From: Pierre Habouzit <madcoder@debian.org>

To: 466663-close@bugs.debian.org

Subject: Bug#466663: fixed in lighttpd 1.4.18-2

Date: Wed, 27 Feb 2008 16:17:06 +0000

Source: lighttpd
Source-Version: 1.4.18-2

We believe that the bug you reported is fixed in the latest version of
lighttpd, which is due to be installed in the Debian FTP archive:

lighttpd-doc_1.4.18-2_all.deb
  to pool/main/l/lighttpd/lighttpd-doc_1.4.18-2_all.deb
lighttpd-mod-cml_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-cml_1.4.18-2_amd64.deb
lighttpd-mod-magnet_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-magnet_1.4.18-2_amd64.deb
lighttpd-mod-mysql-vhost_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.18-2_amd64.deb
lighttpd-mod-trigger-b4-dl_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.18-2_amd64.deb
lighttpd-mod-webdav_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-webdav_1.4.18-2_amd64.deb
lighttpd_1.4.18-2.dsc
  to pool/main/l/lighttpd/lighttpd_1.4.18-2.dsc
lighttpd_1.4.18-2.tar.gz
  to pool/main/l/lighttpd/lighttpd_1.4.18-2.tar.gz
lighttpd_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd_1.4.18-2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 466663@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre Habouzit <madcoder@debian.org> (supplier of updated lighttpd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Wed, 27 Feb 2008 16:56:16 +0100
Source: lighttpd
Binary: lighttpd lighttpd-doc lighttpd-mod-mysql-vhost lighttpd-mod-trigger-b4-dl lighttpd-mod-cml lighttpd-mod-magnet lighttpd-mod-webdav
Architecture: source all amd64
Version: 1.4.18-2
Distribution: unstable
Urgency: high
Maintainer: Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>
Changed-By: Pierre Habouzit <madcoder@debian.org>
Description: 
 lighttpd   - A fast webserver with minimal memory footprint
 lighttpd-doc - Documentation for lighttpd
 lighttpd-mod-cml - Cache meta language module for lighttpd
 lighttpd-mod-magnet - Control the request handling module for lighttpd
 lighttpd-mod-mysql-vhost - MySQL-based virtual host configuration for lighttpd
 lighttpd-mod-trigger-b4-dl - Anti-deep-linking module for lighttpd
 lighttpd-mod-webdav - WebDAV module for lighttpd
Closes: 466663
Changes: 
 lighttpd (1.4.18-2) unstable; urgency=high
 .
   * Move the aliases on /doc/ and /images/ mandated by policy at the end to
     circumvent #445459.
   * Add patches/05_fdevent_fix.dpatch to fix possible remote DoS
     (Closes: 466663).
   * bump urgency for security fix.
Files: 
 160e5cde7277dbb395f1f76bc72f71ce 1185 web optional lighttpd_1.4.18-2.dsc
 0641fe0ccf609a7caa56845de3f9b923 845192 web optional lighttpd_1.4.18-2.tar.gz
 a641cc9c7f970ca7e20ad051d52ae3fb 101896 doc optional lighttpd-doc_1.4.18-2_all.deb
 6893182edf8484c2be680b67c44ad472 314838 web optional lighttpd_1.4.18-2_amd64.deb
 9a34e099a3f2724eb664554b0830256a 62916 web optional lighttpd-mod-mysql-vhost_1.4.18-2_amd64.deb
 caead3bfc9562a7216fb22b1a3413a59 64604 web optional lighttpd-mod-trigger-b4-dl_1.4.18-2_amd64.deb
 685763ddd5d565da306be2dcabca3f93 68070 web optional lighttpd-mod-cml_1.4.18-2_amd64.deb
 be2e09b0d00b9008cecadac4cd0915e6 67730 web optional lighttpd-mod-magnet_1.4.18-2_amd64.deb
 20119e48af0703a893543e2ee946ec1b 74806 web optional lighttpd-mod-webdav_1.4.18-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHxYjtvGr7W6HudhwRAmcPAJ4guEYlUwMWPsn1a1EsYk9kS2HNqgCePcZ0
uk1ZIPxU9x/z73rZU3BGISk=
=Wz6x
-----END PGP SIGNATURE-----

Message #42 received at 466663@bugs.debian.org (full text, mbox, reply):

From: Olaf van der Spek <Olaf@XWIS.Net>

To: 466663@bugs.debian.org

Subject: Stable?

Date: Wed, 05 Mar 2008 10:33:33 +0100

Hi,

What about stable?

Greetings,

Olaf

Message #47 received at 466663@bugs.debian.org (full text, mbox, reply):

From: root <ichdarfdas@ichbinroot.de>

To: 466663@bugs.debian.org

Subject: Please fix this in stable.

Date: Tue, 08 Apr 2008 09:54:28 +0200

Stable is also affected, see [1].
Patch can be found here [2].


[1] http://www.lighttpd.net/security/lighttpd_sa_2008_01.txt
[2] http://www.lighttpd.net/security/lighttpd-1.4.x_high_load_dos.patch

Message #52 received at 466663@bugs.debian.org (full text, mbox, reply):

From: root <ichdarfdas@ichbinroot.de>

To: 466663@bugs.debian.org

Subject: Still no fix for stable?

Date: Wed, 04 Jun 2008 10:57:41 +0200

Still no fix for stable?

Send a report that this bug log contains spam.