Date: Mon, 25 May 2015 18:04:03 +0300 From: Jaanus <jaanus.kaap@...il.com> To: oss-security@...ts.openwall.com Subject: CVE-2015-3200 Log injection in Lighttpd CVE: CVE-2015-3200 Software: Lighttpd Type: Log injection Source code Location: http_auth.c:860 Vulnerable servers: Servers that use basic authentication Description: When basic HTTP authentication base64 string does not contain colon character (or contains it after NULL byte - can be inserted inside base64 encoding), then that situation is logged with a string ": is missing in " and the simply decoded base64 string. This means that new lines, NULL byte and everything else can be encoded with base64 and are then inserted to logs as they are after decoding. For example header "Authorization: Basic dGVzdAAKMjEwMC0wMS0wMSAwMDowMDowMDogKG1hZ2ljLmMuODU5KSBJVCdTIFRIRSBFTkQgT0YgVEhFIFdPUkxEIQ==" results in two log lines: " 2015-05-14 12:55:54: (http_auth.c.859) : is missing in test 2100-01-01 00:00:00: (magic.c.859) IT'S THE END OF THE WORLD " http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ