lighttpd（发音为lighty）是一套开放源代码的网页服务器，以BSD许可证发布。相较于其他的网页服务器，lighttpd仅需少量的存储器及CPU资源即可达到同样的性能。今天lighttpd 团队对外发布公告，包括最新版本1.4.29在内的所有版本存在通过mod_auth 模块在base64加密字符的时候会出现符号错误导致的越界漏洞。
具体信息参见：
out-of-bounds read due to signedness error
============================================
CVE-2011-4362 was assigned to this bug.
Description
-------------
For http auth we need to base64-decode user input; the allowed character range
includes non ASCII characters above 0x7f.
The function to decode this string takes a "const char *in"; and reads
each character into an "int ch", which is used as offset in the table.
So characters above 0x80 lead to negative indices (as char is signed on most
platforms).
Thanks to Xi Wang who discovered the issue.
Detailed analysis
-------------------
Here the vulnerable code (src/http_auth.c:67)
---
static const short base64_reverse_table[256] = ...;
static unsigned char * base64_decode(buffer *out, const char *in) {
...
int ch, ...;
size_t i;
...
ch = in[i];
...
ch = base64_reverse_table[ch];
...
}
---
It doesn't matter if "broken" data is read - it just may allow more
encodings of the correct login information.
The only possible impact is a segfault, leading to DoS.
I had a look at some debian and openSUSE binaries, and it looks like
there is always enough data (>= 256 bytes) in the .rodata section before the
base64_reverse_table table, so these binaries are not vulnerable.
Upstream issue
----------------
Affected versions
-------------------
all versions before 1.4.30 / svn revision 2806
not all binaries are vulnerable (no vulnerable one found yet)
Fixed in
----------
1.4.x:
1.5:
Solutions or Workaround
-------------------------
There is no workaround (unless you don't need mod_auth and you just disable it).
Apply lighttpd-fix-base64-signedness.patch, also inline below (patch applies
to both 1.4.x and 1.5)
Patch
-------
lighttpd-fix-base64-signedness.patch:
===
diff --git a/src/http_auth.c b/src/http_auth.c
index f2f86dd..33adf71 100644
--- a/src/http_auth.c
+++ b/src/http_auth.c
@@ -99,7 +99,7 @@ static unsigned char * base64_decode(buffer *out, const char *in) {
ch = in[0];
/* run through the whole string, converting as we go */
for (i = 0; i < in_len; i++) {
- ch = in[i];
+ ch = (unsigned char) in[i];
if (ch == '\0') break;
===
该漏洞影响了当前lighttpd的所有发布版本以及SVN r2806 之前的版本。目前官方已经发布了补丁，估计新版本1.4.30也会不久发布。下载patch：
这个漏洞()是一个叫"Xi Wang"的国人发现的。
注：如果你的lighttpd 没有启用mod_auth 模块，则可以表示影响不大。
相关介绍：
Lighttpd是一个德国人领导的开源软件，其根本的目的是提供一个专门针对高性能网站，安全、快速、兼容性好并且灵活的web server环境。具有非常低的内存开销，cpu占用率低，效能好，以及丰富的模块等特点。lighttpd是众多OpenSource轻量级的web server中较为优秀的一个。支持FastCGI， CGI， Auth， 输出压缩（output compress）， URL重写， Alias等重要功能，而Apache之所以流行，很大程度也是因为功能丰富，在lighttpd上很多功能都有相应的实现了，这点对于apache的用户是非常重要的，因为迁移到lighttpd就必须面对这些问题。