CVE-2015-3200 : mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authenticati

mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.

Published 2015-06-09 14:59:01

Updated 2016-12-24 02:59:12

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-3200

HP » Virtual Customer Access System
Versions up to, including, (<=) 15.07
cpe:2.3:a:hp:virtual_customer_access_system:*:*:*:*:*:*:*:*
Matching versions
Oracle » Solaris » Version: 11.3
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
Matching versions
Lighttpd » Lighttpd
Versions up to, including, (<=) 1.4.35
cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2015-3200

Top countries where our scanners detected CVE-2015-3200

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-3200 1,246,272

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-3200!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-3200

EPSS FAQ

0.77%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-3200

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2015-3200

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-3200

http://redmine.lighttpd.net/issues/2646

Bug #2646: Log injection vulnerability in mod_auth - Lighttpd - lighty labs
Vendor Advisory
http://www.securitytracker.com/id/1032405

lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries - SecurityTracker
VDB Entry
http://jaanuskp.blogspot.com/2015/05/cve-2015-3200.html

Blog niet gevonden
Exploit;Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Oracle Solaris Third Party Bulletin - October 2015
Third Party Advisory

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375

HPSBGN03638 rev.1 - HPE Remote Device Access: Virtual Customer Access System (vCAS) using lighttpd and OpenSSH, Unauthorized Modification of Information, Remote Denial of Service (DoS), Remote Disclos
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/74813

Lighttpd 'http_auth.c' Security Bypass Vulnerability
https://kc.mcafee.com/corporate/index?page=content&id=SB10310

McAfee Security Bulletin - Network Security Manager/Network Security Platform/Network Threat Behavior Analysis update fixes multiple vulnerabilities (CVE-2013-4559, CVE-2015-3200, CVE-2016-2183, CVE-2

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163223.html

[SECURITY] Fedora 22 Update: lighttpd-1.4.36-1.fc22
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163286.html

[SECURITY] Fedora 21 Update: lighttpd-1.4.36-1.fc21