CVE-2008-1531

2008-03-2700:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

0.1

Percentile

95.0%

JSON

The connection_state_machine function (connections.c) in lighttpd 1.4.19
and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a
denial of service (active SSL connection loss) by triggering an SSL error,
such as disconnecting before a download has finished, which causes all
active SSL connections to be lost.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu6.10noarchlighttpd< 1.4.13~r1370-1ubuntu1.7UNKNOWN
ubuntu7.04noarchlighttpd< 1.4.13-9ubuntu4.6UNKNOWN
ubuntu7.10noarchlighttpd< 1.4.18-1ubuntu1.4UNKNOWN
ubuntu8.04noarchlighttpd< 1.4.19-0ubuntu3UNKNOWN
ubuntu8.10noarchlighttpd< 1.4.19-0ubuntu3UNKNOWN
ubuntu9.04noarchlighttpd< 1.4.19-0ubuntu3UNKNOWN
ubuntu9.10noarchlighttpd< 1.4.19-0ubuntu3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.10	noarch	lighttpd	< 1.4.13~r1370-1ubuntu1.7	UNKNOWN
ubuntu	7.04	noarch	lighttpd	< 1.4.13-9ubuntu4.6	UNKNOWN
ubuntu	7.10	noarch	lighttpd	< 1.4.18-1ubuntu1.4	UNKNOWN
ubuntu	8.04	noarch	lighttpd	< 1.4.19-0ubuntu3	UNKNOWN
ubuntu	8.10	noarch	lighttpd	< 1.4.19-0ubuntu3	UNKNOWN
ubuntu	9.04	noarch	lighttpd	< 1.4.19-0ubuntu3	UNKNOWN
ubuntu	9.10	noarch	lighttpd	< 1.4.19-0ubuntu3	UNKNOWN