Description

mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak, (2) use of md5-sess without a cnonce, (3) base64 encoded strings, and (4) trailing whitespace in the Auth-Digest header.

Remediation

References

CVE-2007-3946

Related Vulnerabilities

Dotclear Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5689)

WordPress Plugin Gravity Forms Constant Contact Cross-Site Scripting (1.0.5)

Lighttpd Other Vulnerability (CVE-2007-1870)

WordPress Plugin Warranties and Returns for WooCommerce Security Bypass (5.2.1)

Jenkins Missing Authorization Vulnerability (CVE-2021-21685)

Severity

Medium

Classification

CVE-2007-3946

Tags

Missing Update Known Vulnerabilities