Wind River Support Network

HomeDefectsLIN5-7601
Fixed

LIN5-7601 : Security Advisory - lighttpd - CVE-2013-4508

Created: Nov 15, 2013    Updated: Dec 19, 2017
Resolved Date: Jan 22, 2014
Found In Version: 5.0.1
Fix Version: 5.0.1.12
Severity: Standard
Applicable for: Wind River Linux 5
Component/s: Userspace

Description

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.Per: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt

All versions from 1.4.24 (first version supporting SNI) up to and including
1.4.33.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4508

Workaround

Unknown

Steps to Reproduce

Unknown

Other Downloads


Live chat
Online