Debian Bug report logs - #466663
lighttpd: remote denial of service

version graph

Package: lighttpd; Maintainer for lighttpd is Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>; Source for lighttpd is src:lighttpd.

Reported by: u0@desibbrg.com

Date: Wed, 20 Feb 2008 08:42:01 UTC

Severity: critical

Tags: patch, security

Found in versions lighttpd/1.4.13-4etch4, lighttpd/1.4.18-1

Fixed in version lighttpd/1.4.18-2

Done: Pierre Habouzit <madcoder@debian.org>

Bug is archived. No further changes may be made.

Forwarded to http://trac.lighttpd.net/trac/ticket/1562

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to u0@desibbrg.com:
New Bug report received and forwarded. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: u0@desibbrg.com
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: fdevent.c.171: aborted
Date: Wed, 20 Feb 2008 09:38:44 +0100
Package: lighttpd
Version: 1.4.13-4etch4
Severity: important

Hi,

Lighttpd crashed with this strace:
ioctl(982, FIONREAD, [0])               = 0
read(982, 0x8649ed0, 1471)              = -1 EAGAIN (Resource temporarily unavailable)
time(NULL)                              = 1203496074
poll([{fd=4, events=POLLIN}, {fd=6, events=POLLOUT}, {fd=7, events=POLLOUT}, {fd=8, events=POLLOUT}, {fd=9, events=POLLOUT}, {fd=10, events=POLLOUT}, {fd=16, events=POLLOUT}, {fd=18, events=POLLOUT}, {fd=20, events=POLLOUT}, {fd=22, events=POLLOUT}, {fd=24, 
events=POLLOUT}, {fd=26, events=POLLOUT}, {fd=28, events=POLLOUT}, {fd=30, events=POLLOUT}, {fd=32, events=POLLOUT}, {fd=34, events=POLLOUT}, {fd=36, events=POLLOUT}, {fd=38, events=POLLOUT}, {fd=40, events=POLLOUT}, {fd=41, events=POLLOUT}, {fd=44, 
events=POLLOUT}, {fd=46, events=POLLOUT}, {fd=48, events=POLLOUT}, {fd=50, events=POLLOUT}, {fd=52, events=POLLOUT}, {fd=190, events=POLLOUT}, {fd=56, events=POLLOUT}, {fd=124, events=POLLOUT}, {fd=58, events=POLLOUT}, {fd=60, events=POLLOUT}, {fd=62, 
events=POLLOUT}, {fd=64, events=POLLOUT}, ...], 530, 1000) = 1
write(2, "fdevent.c.171: aborted\n", 23) = 23
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
tgkill(19774, 19774, SIGABRT)           = 0
--- SIGABRT (Aborted) @ 0 (0) ---
Process 19774 detached

It looks familiar, I think this has been fixed upstream.

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable'), (1, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-6-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages lighttpd depends on:
ii  libattr1               2.4.32-1          Extended attribute shared library
ii  libbz2-1.0             1.0.3-6           high-quality block-sorting file co
ii  libc6                  2.3.6.ds1-13etch5 GNU C Library: Shared libraries
ii  libldap2               2.1.30-13.3       OpenLDAP libraries
ii  libpcre3               6.7+7.4-3         Perl 5 Compatible Regular Expressi
ii  libssl0.9.8            0.9.8c-4etch1     SSL shared libraries
ii  lsb-base               3.1-23.2etch1     Linux Standard Base 3.1 init scrip
ii  mime-support           3.39-1            MIME files 'mime.types' & 'mailcap
ii  zlib1g                 1:1.2.3-13        compression library - runtime

Versions of packages lighttpd recommends:
ii  php5-cgi                  5.2.0-8+etch10 server-side, HTML-embedded scripti

-- no debconf information




Noted your statement that Bug has been forwarded to http://trac.lighttpd.net/trac/ticket/1562. Request was from Olaf van der Spek <Olaf@XWIS.Net> to control@bugs.debian.org. (Wed, 20 Feb 2008 09:03:01 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to Olaf van der Spek <OlafvdSpek@GMail.Com>:
Extra info received and forwarded to list. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #12 received at 466663@bugs.debian.org (full text, mbox):

From: Olaf van der Spek <OlafvdSpek@GMail.Com>
To: Debian Bug Tracking System <466663@bugs.debian.org>
Subject: lighttpd: 1.4.18 is also affected
Date: Thu, 21 Feb 2008 20:53:23 +0100
Package: lighttpd
Version: 1.4.18-1
Followup-For: Bug #466663

Hi,

1.4.18 is also affected and this bug is remotely exploitable, causing a crash (DoS).

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable'), (1, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-6-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages lighttpd depends on:
ii  libattr1               2.4.32-1          Extended attribute shared library
ii  libbz2-1.0             1.0.3-6           high-quality block-sorting file co
ii  libc6                  2.3.6.ds1-13etch5 GNU C Library: Shared libraries
ii  libfam0                2.7.0-12          Client library to control the FAM 
ii  libldap2               2.1.30-13.3       OpenLDAP libraries
ii  libpcre3               6.7+7.4-3         Perl 5 Compatible Regular Expressi
ii  libssl0.9.8            0.9.8c-4etch1     SSL shared libraries
ii  libterm-readline-perl- 1.0302-1          Perl implementation of Readline li
ii  lsb-base               3.1-23.2etch1     Linux Standard Base 3.1 init scrip
ii  mime-support           3.39-1            MIME files 'mime.types' & 'mailcap
ii  zlib1g                 1:1.2.3-13        compression library - runtime

lighttpd recommends no packages.

-- no debconf information




Severity set to `critical' from `important' Request was from Olaf van der Spek <Olaf@XWIS.Net> to control@bugs.debian.org. (Thu, 21 Feb 2008 19:57:02 GMT) Full text and rfc822 format available.

Tags added: security Request was from Olaf van der Spek <Olaf@XWIS.Net> to control@bugs.debian.org. (Thu, 21 Feb 2008 21:12:04 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to Nico Golde <nion@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #21 received at 466663@bugs.debian.org (full text, mbox):

From: Nico Golde <nion@debian.org>
To: 466663@bugs.debian.org
Cc: control@bugs.debian.org
Subject: lighttpd remote DoS
Date: Mon, 25 Feb 2008 12:47:43 +0100
[Message part 1 (text/plain, inline)]
tags 466663 + patch
thanks

Is anyone working on an updated package?
There is a patch on:
http://trac.lighttpd.net/trac/attachment/ticket/1562/Fix-372-and-1562.patch

and I'd prepare an NMU otherwise.
Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
[Message part 2 (application/pgp-signature, inline)]

Bug marked as found in version 1.4.18-1+b1. Request was from Nico Golde <nion@debian.org> to control@bugs.debian.org. (Mon, 25 Feb 2008 11:48:03 GMT) Full text and rfc822 format available.

Tags added: patch Request was from Nico Golde <nion@debian.org> to control@bugs.debian.org. (Mon, 25 Feb 2008 11:48:04 GMT) Full text and rfc822 format available.

Changed Bug title to `lighttpd: remote denial of service' from `fdevent.c.171: aborted'. Request was from Nico Golde <nion@debian.org> to control@bugs.debian.org. (Mon, 25 Feb 2008 12:27:02 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to Pierre Habouzit <madcoder@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #32 received at 466663@bugs.debian.org (full text, mbox):

From: Pierre Habouzit <madcoder@debian.org>
To: Nico Golde <nion@debian.org>, 466663@bugs.debian.org
Cc: control@bugs.debian.org
Subject: Re: Bug#466663: lighttpd remote DoS
Date: Mon, 25 Feb 2008 13:51:25 +0100
[Message part 1 (text/plain, inline)]
On Mon, Feb 25, 2008 at 11:47:43AM +0000, Nico Golde wrote:
> tags 466663 + patch
> thanks
> 
> Is anyone working on an updated package?
> There is a patch on:
> http://trac.lighttpd.net/trac/attachment/ticket/1562/Fix-372-and-1562.patch

  I will today or tomorrow for unstable.


-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org
[Message part 2 (application/pgp-signature, inline)]

Reply sent to Pierre Habouzit <madcoder@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to u0@desibbrg.com:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #37 received at 466663-close@bugs.debian.org (full text, mbox):

From: Pierre Habouzit <madcoder@debian.org>
To: 466663-close@bugs.debian.org
Subject: Bug#466663: fixed in lighttpd 1.4.18-2
Date: Wed, 27 Feb 2008 16:17:06 +0000
Source: lighttpd
Source-Version: 1.4.18-2

We believe that the bug you reported is fixed in the latest version of
lighttpd, which is due to be installed in the Debian FTP archive:

lighttpd-doc_1.4.18-2_all.deb
  to pool/main/l/lighttpd/lighttpd-doc_1.4.18-2_all.deb
lighttpd-mod-cml_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-cml_1.4.18-2_amd64.deb
lighttpd-mod-magnet_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-magnet_1.4.18-2_amd64.deb
lighttpd-mod-mysql-vhost_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.18-2_amd64.deb
lighttpd-mod-trigger-b4-dl_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.18-2_amd64.deb
lighttpd-mod-webdav_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd-mod-webdav_1.4.18-2_amd64.deb
lighttpd_1.4.18-2.dsc
  to pool/main/l/lighttpd/lighttpd_1.4.18-2.dsc
lighttpd_1.4.18-2.tar.gz
  to pool/main/l/lighttpd/lighttpd_1.4.18-2.tar.gz
lighttpd_1.4.18-2_amd64.deb
  to pool/main/l/lighttpd/lighttpd_1.4.18-2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 466663@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre Habouzit <madcoder@debian.org> (supplier of updated lighttpd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Wed, 27 Feb 2008 16:56:16 +0100
Source: lighttpd
Binary: lighttpd lighttpd-doc lighttpd-mod-mysql-vhost lighttpd-mod-trigger-b4-dl lighttpd-mod-cml lighttpd-mod-magnet lighttpd-mod-webdav
Architecture: source all amd64
Version: 1.4.18-2
Distribution: unstable
Urgency: high
Maintainer: Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>
Changed-By: Pierre Habouzit <madcoder@debian.org>
Description: 
 lighttpd   - A fast webserver with minimal memory footprint
 lighttpd-doc - Documentation for lighttpd
 lighttpd-mod-cml - Cache meta language module for lighttpd
 lighttpd-mod-magnet - Control the request handling module for lighttpd
 lighttpd-mod-mysql-vhost - MySQL-based virtual host configuration for lighttpd
 lighttpd-mod-trigger-b4-dl - Anti-deep-linking module for lighttpd
 lighttpd-mod-webdav - WebDAV module for lighttpd
Closes: 466663
Changes: 
 lighttpd (1.4.18-2) unstable; urgency=high
 .
   * Move the aliases on /doc/ and /images/ mandated by policy at the end to
     circumvent #445459.
   * Add patches/05_fdevent_fix.dpatch to fix possible remote DoS
     (Closes: 466663).
   * bump urgency for security fix.
Files: 
 160e5cde7277dbb395f1f76bc72f71ce 1185 web optional lighttpd_1.4.18-2.dsc
 0641fe0ccf609a7caa56845de3f9b923 845192 web optional lighttpd_1.4.18-2.tar.gz
 a641cc9c7f970ca7e20ad051d52ae3fb 101896 doc optional lighttpd-doc_1.4.18-2_all.deb
 6893182edf8484c2be680b67c44ad472 314838 web optional lighttpd_1.4.18-2_amd64.deb
 9a34e099a3f2724eb664554b0830256a 62916 web optional lighttpd-mod-mysql-vhost_1.4.18-2_amd64.deb
 caead3bfc9562a7216fb22b1a3413a59 64604 web optional lighttpd-mod-trigger-b4-dl_1.4.18-2_amd64.deb
 685763ddd5d565da306be2dcabca3f93 68070 web optional lighttpd-mod-cml_1.4.18-2_amd64.deb
 be2e09b0d00b9008cecadac4cd0915e6 67730 web optional lighttpd-mod-magnet_1.4.18-2_amd64.deb
 20119e48af0703a893543e2ee946ec1b 74806 web optional lighttpd-mod-webdav_1.4.18-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHxYjtvGr7W6HudhwRAmcPAJ4guEYlUwMWPsn1a1EsYk9kS2HNqgCePcZ0
uk1ZIPxU9x/z73rZU3BGISk=
=Wz6x
-----END PGP SIGNATURE-----





Information forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to Olaf van der Spek <Olaf@XWIS.Net>:
Extra info received and forwarded to list. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #42 received at 466663@bugs.debian.org (full text, mbox):

From: Olaf van der Spek <Olaf@XWIS.Net>
To: 466663@bugs.debian.org
Subject: Stable?
Date: Wed, 05 Mar 2008 10:33:33 +0100
Hi,

What about stable?

Greetings,

Olaf




Information forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to root <ichdarfdas@ichbinroot.de>:
Extra info received and forwarded to list. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #47 received at 466663@bugs.debian.org (full text, mbox):

From: root <ichdarfdas@ichbinroot.de>
To: 466663@bugs.debian.org
Subject: Please fix this in stable.
Date: Tue, 08 Apr 2008 09:54:28 +0200
Stable is also affected, see [1].
Patch can be found here [2].


[1] http://www.lighttpd.net/security/lighttpd_sa_2008_01.txt
[2] http://www.lighttpd.net/security/lighttpd-1.4.x_high_load_dos.patch




Information forwarded to debian-bugs-dist@lists.debian.org, Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>:
Bug#466663; Package lighttpd. Full text and rfc822 format available.

Acknowledgement sent to root <ichdarfdas@ichbinroot.de>:
Extra info received and forwarded to list. Copy sent to Debian lighttpd maintainers <pkg-lighttpd-maintainers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #52 received at 466663@bugs.debian.org (full text, mbox):

From: root <ichdarfdas@ichbinroot.de>
To: 466663@bugs.debian.org
Subject: Still no fix for stable?
Date: Wed, 04 Jun 2008 10:57:41 +0200
Still no fix for stable?




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 16 Mar 2009 09:36:47 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Apr 17 16:06:13 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.