This host is running Lighttpd and is prone to multiple vulnerabilities

Successful exploitation will allow remote attackers to execute arbitrary SQL commands and remote attackers to read arbitrary files via hostname. Impact Level: System/Application

Upgrade to 1.4.35 or higher, For updates refer to http://www.lighttpd.net/download

- mod_mysql_vhost module not properly sanitizing user supplied input passed via the hostname. - mod_evhost and mod_simple_vhost modules not properly sanitizing user supplied input via the hostname.

Lighttpd version before 1.4.35

Send a crafted HTTP GET request and check whether it responds with error message.

• http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt
• http://osvdb.org/104381
• http://osvdb.org/104382
• http://seclists.org/oss-sec/2014/q1/561

---

Updated on 2015-03-25