CVE-2015-3200
published 2015-06-09CVE-2015-3200: mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as…
PriorityP347high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EPSS
9.98%
95.1th percentile
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | lighttpd | < lighttpd 1.4.37-1 (bookworm) | lighttpd 1.4.37-1 (bookworm) |
| hp | virtual_customer_access_system | <= 15.07 | — |
| lighttpd | lighttpd | <= 1.4.35 | — |
| lighttpd | lighttpd | >= 0 < 1.4.37-1 | 1.4.37-1 |
| lighttpd | lighttpd | >= 0 < 1.4.37-1 | 1.4.37-1 |
| lighttpd | lighttpd | >= 0 < 1.4.37-1 | 1.4.37-1 |
| lighttpd | lighttpd | >= 0 < 1.4.37-1 | 1.4.37-1 |
| lighttpd | lighttpd | >= 0 < 1.4.33-1+nmu2ubuntu2.1+esm1 | 1.4.33-1+nmu2ubuntu2.1+esm1 |
| lighttpd | lighttpd | >= 0 < 1.4.35-4ubuntu2.1+esm1 | 1.4.35-4ubuntu2.1+esm1 |
| lighttpd | lighttpd | >= 0 < 1.4.45-1ubuntu3.18.04.1+esm1 | 1.4.45-1ubuntu3.18.04.1+esm1 |
| oracle | solaris | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5LOW
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fxx4-pv62-6956: mod_auth in lighttpd before 1
ghsa_unreviewed·2022-05-17
CVE-2015-3200 [HIGH] CWE-74 GHSA-fxx4-pv62-6956: mod_auth in lighttpd before 1
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
OSV
lighttpd vulnerabilities
osv·2021-03-15·CVSS 7.5
CVE-2015-3200 [HIGH] lighttpd vulnerabilities
lighttpd vulnerabilities
It was discovered that Lighttpd did not properly sanitized the string used in
basic HTTP authentication method. A remote attacker could use this to inject
arbitrary log entries and maybe obtain sensitive information. This issue only
affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-3200)
It was discovered that Lighttpd did not properly sanitized the string used in
alias. A remote attacker could use this to access the content of the directory
above the alias and obtain sensitive information. (CVE-2018-19052)
OSV
CVE-2015-3200: mod_auth in lighttpd before 1
osv·2015-06-09·CVSS 7.5
CVE-2015-3200 [HIGH] CVE-2015-3200: mod_auth in lighttpd before 1
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Ubuntu
Lighttpd vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 7.5
CVE-2015-3200 [HIGH] Lighttpd vulnerabilities
Title: Lighttpd vulnerabilities
Summary: Lighttpd could be made to expose sensitive information over the
network.
It was discovered that Lighttpd did not properly sanitized the string used in
basic HTTP authentication method. A remote attacker could use this to inject
arbitrary log entries and maybe obtain sensitive information. This issue only
affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-3200)
It was discovered that Lighttpd did not properly sanitized the string used in
alias. A remote attacker could use this to access the content of the directory
above the alias and obtain sensitive information. (CVE-2018-19052)
Instructions: After a standard system update you need to restart Lighttpd to make
all the necessary changes.
Debian
CVE-2015-3200: lighttpd - mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary l...
vendor_debian·2015·CVSS 7.5
CVE-2015-3200 [HIGH] CVE-2015-3200: lighttpd - mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary l...
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Scope: local
bookworm: resolved (fixed in 1.4.37-1)
bullseye: resolved (fixed in 1.4.37-1)
forky: resolved (fixed in 1.4.37-1)
sid: resolved (fixed in 1.4.37-1)
trixie: resolved (fixed in 1.4.37-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header
bugzilla·2015-05-26·CVSS 7.5
CVE-2015-3200 [HIGH] CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header
CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header
A flaw was found in Lighttpd:
When basic HTTP authentication base64 string does not contain colon character (or contains it after NULL byte - can be inserted inside base64 encoding), then that situation is logged with a string ": is missing in " and the simply decoded base64 string. This means that new lines, NULL byte and everything else can be encoded with base64 and are then inserted to logs as they are after decoding.
For example header "Authorization: Basic dGVzdAAKMjEwMC0wMS0wMSAwMDowMDowMDogKG1hZ2ljLmMuODU5KSBJVCdTIFRIRSBFTkQgT0YgVEhFIFdPUkxEIQ==" results in two log lines:
"
2015-05-14 12:55:54: (http_auth.c.859) : is missing in test
2100-01-01 00:00:00: (magic.c.859) IT'S THE END OF THE W
Bugzilla
CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header [fedora-all]
bugzilla·2015-05-26·CVSS 7.5
CVE-2015-3200 [HIGH] CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header [fedora-all]
CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header [epel-all]
bugzilla·2015-05-26·CVSS 7.5
CVE-2015-3200 [HIGH] CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header [epel-all]
CVE-2015-3200 lighttpd: log injection via malformed base64 string in Authentication header [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.htmlhttp://redmine.lighttpd.net/issues/2646http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/74813http://www.securitytracker.com/id/1032405https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375https://kc.mcafee.com/corporate/index?page=content&id=SB10310http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.htmlhttp://redmine.lighttpd.net/issues/2646http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/74813http://www.securitytracker.com/id/1032405https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375https://kc.mcafee.com/corporate/index?page=content&id=SB10310
2015-06-09
Published