CVE-2018-25103: 
lighttpd vulnerability analysis and mitigation

A use-after-free vulnerability exists in lighttpd versions 1.4.50 and earlier in the HTTP request parsing functionality (CVE-2018-25103). The vulnerability was discovered by VDOO researchers in November 2018 and was fixed in version 1.4.51 released in August 2018. The issue affects multiple devices and systems using the vulnerable lighttpd versions, particularly in IoT devices and embedded systems (CERT/CC, SecurityOnline).

The vulnerability occurs in the HTTP header parsing code where pointers to header values stored in con->request are not updated if the header value is reallocated when folded header lines are appended. This can result in the server reading from invalid pointers to memory used in the same request. The issue has a CVSS v3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (SecurityOnline, RunZero).

The vulnerability can lead to information disclosure where an attacker can confirm whether a string referred to by previously-used pointer is equal to a separate string provided by the attacker. While the impact is limited as attackers can only confirm values they already know, the vulnerability affects numerous devices from various manufacturers, particularly in IoT and embedded systems (RunZero, SecurityOnline).

The primary mitigation is to update lighttpd to version 1.4.51 or later which contains the fix. For systems that cannot be updated, network segmentation is recommended to prevent access to these outdated lighttpd services from untrusted networks. For specific devices like BMCs, it's recommended to isolate these interfaces to a dedicated management network and use VPNs for remote access (RunZero, CERT/CC).

Intel and Lenovo have indicated that their affected products are end-of-life (EOL) and will not receive updates. AMI has released updated firmware for affected systems. The vulnerability has raised concerns about supply-chain security, as many organizations failed to recognize the necessity of the security fix due to the initial lack of a CVE identifier (RunZero).