Buffer Overflow Vulnerability in OpenLiteSpeed Server by LiteSpeed
CVE-2018-19792

6.7MEDIUM

Key Information:

Vendor

Litespeedtech

Status
Openlitespeed
Vendor
CVE Published:
3 December 2018

What is CVE-2018-19792?

The OpenLiteSpeed server prior to version 1.5.0 RC6 is susceptible to a buffer overflow vulnerability that allows local users to manipulate symlinks and pass overly long command names to the server. This mismanagement in the LshttpdMain::getServerRootFromExecutablePath function could enable attackers to execute denial-of-service attacks or lead to unforeseen system behavior, highlighting the importance of timely updates and security practices for maintaining server integrity.

References

https://github.com/litespeedtech/openlitespeed/issues/117
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.