Security bugs are reported here via bugzilla

[Elisamuel Resto <samuel AT dragonboricua.net>]

Synopsis
========
Some vulnerabilities have been reported in lighttpd, which can be exploited
by malicious people to bypass certain security restrictions, cause a
DoS (Denial of Service), or potentially to compromise a vulnerable system.

Background
==========
lighttpd is a secure, fast, compliant, and very flexible Web server which
has been optimized for high-performance environments. It has a very low
memory footprint compared to other Web servers, and it takes care of CPU
load.

Description
===========
Several vulnerabilities were found in lighttpd, including an error parsing
HTTP headers[1] that can be exploited to cause a DoS, an error in mod_auth
when using MD5-sess algorithm[2] that can lead to a DoS condition, an error
when parsing Auth-Digest headers in mod_auth[3] that can be potentially be
exploited to cause a DoS, an error in the mechanism that limits number of
active connections[4], an error in the processing of HTTP requests[5]
that can be exploited to access restricted files, an error in mod_scgi[6]
that can be exploited to cause a DoS by sending a SCGI request and closing
the connection while lighttpd processes the request, an improper check on
the return value of base64_decode in mod_auth[7] for parsing the
credentials for basic authentication which could lead to access of
uninitialized memory space, an error in the header parsing code[8] that can
lead to access of memory outside the original boundaries which can cause
memory corruption.

Successful exploitation of this vulnerability can potentially be used to
execute arbitrary code with the privileges of the user running lighttpd.

For more information regarding this issue, and CVE numbers along with
additional information, please visit the Secunia[9] page and the
announcement in the lighttpd page[10].

Affected packages
=================
These vulnerabilities were reported for lighttpd version 1.4.15, but
previous versions may also be affected. lighttpd in all grimoires is
affected by this vulnerability.

This is now fixed in test, stable-rc and stable grimoire.

Resolution
==========
All php users should upgrade to the latest available version:
# scribe update
# cast -c lighttpd

If you maintain your own instalation of lighttpd ouside of sorcery, there
are patches available from upstream, please visit the lighttpd announcement
page[10] for information on where to obtain these.

References
==========
    [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3947
[2,3,7] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3946 
    [4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3948
    [5] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3949
    [6] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3950
    [8] http://www.lighttpd.net/assets/2007/7/24/lighttpd_sa2007_06.txt
    [9] http://secunia.com/advisories/26130/
   [10] http://www.lighttpd.net/2007/7/24/1-4-16-let-s-ship-it

-- 
Elisamuel Resto <samuel AT dragonboricua.net>
Source Mage GNU/Linux / http://www.sourcemage.org
ID: 0x18615F19 / FP: B66D 1C2A E8EE B922 1D9C D98F D2D5 FB61 1861 5F19

Attachment: signature.asc
Description: PGP signature