Bug 849059 (CVE-2013-4508) - VUL-0: CVE-2013-4508: lighttpd using vulnerable cipher suites with SNI
Summary: VUL-0: CVE-2013-4508: lighttpd using vulnerable cipher suites with SNI
Status: RESOLVED FIXED
Alias: CVE-2013-4508
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.1
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-05 16:37 UTC by Victor Pereira
Modified: 2014-01-15 17:04 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2013-11-05 16:37:29 UTC 
CVE-2013-4508

When defining an ssl.cipher-list, it works for the 'default' HTTPS setup ($SERVER["socket"] 443 block), but when you utilize SNI ($HTTP["host"] blocks within the $SERVER["socket"] block) the ssl.cipher-list seems to not inherit into the host blocks and instead will default to include all of the available openssl ciphers (except SSL v2/v3 based if those are disabled).

References:
http://comments.gmane.org/gmane.comp.security.oss.general/11414
http://redmine.lighttpd.net/issues/2525
Comment 1 Swamp Workflow Management 2013-11-06 23:00:08 UTC 
bugbot adjusting priority
Comment 2 Marcus Rückert 2013-12-11 11:23:39 UTC 
submitted for 12.2 and newer. the SNI feature is not present in any of the SLES versions.
Comment 3 Marcus Meissner 2014-01-14 08:51:43 UTC 
will be released soonish
Comment 4 Sebastian Krahmer 2014-01-15 15:56:21 UTC 
released
Comment 5 Swamp Workflow Management 2014-01-15 16:05:36 UTC 
openSUSE-SU-2014:0072-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 849059,850468,850469
CVE References: CVE-2013-4508,CVE-2013-4559,CVE-2013-4560
Sources used:
openSUSE 13.1 (src):    lighttpd-1.4.32-2.5.1
openSUSE 12.3 (src):    lighttpd-1.4.31-6.5.1
openSUSE 12.2 (src):    lighttpd-1.4.31-4.13.1
Comment 6 Swamp Workflow Management 2014-01-15 17:04:32 UTC 
openSUSE-SU-2014:0074-1: An update that solves one vulnerability and has three fixes is now available.

Category: security (moderate)
Bug References: 790258,849059,850468,850469
CVE References: CVE-2012-5533
Sources used:
openSUSE 11.4 (src):    lighttpd-1.4.32-37.1