lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.Per: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt All versions from 1.4.24 (first version supporting SNI) up to and including 1.4.33. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4508
Unknown
Unknown
