Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAJiKPjH32c38GHwGdBU8FJ-evg+ZPG0jcfn4F3s2SLdv3n-2HA@mail.gmail.com>
Date: Mon, 25 May 2015 18:04:03 +0300
From: Jaanus <jaanus.kaap@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-3200 Log injection in Lighttpd

CVE: CVE-2015-3200
Software: Lighttpd
Type: Log injection
Source code Location: http_auth.c:860
Vulnerable servers: Servers that use basic authentication
Description: When basic HTTP authentication base64 string does not contain
colon character (or contains it after NULL byte - can be inserted inside
base64 encoding), then that situation is logged with a string ": is missing
in " and the simply decoded base64 string. This means that new lines, NULL
byte and everything else can be encoded with base64 and are then inserted
to logs as they are after decoding.

For example header "Authorization: Basic
dGVzdAAKMjEwMC0wMS0wMSAwMDowMDowMDogKG1hZ2ljLmMuODU5KSBJVCdTIFRIRSBFTkQgT0YgVEhFIFdPUkxEIQ=="
results in two log lines:
"
2015-05-14 12:55:54: (http_auth.c.859) : is missing in test
2100-01-01 00:00:00: (magic.c.859) IT'S THE END OF THE WORLD
"


http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.html

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.