Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw

Cyber Security

Apr 15, 2024NewsroomFirmware Security / Vulnerability

A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal.

While the original shortcoming was discovered and patched by the Lighttpd maintainers way back in August 2018 with version 1.4.51, the lack of a CVE identifier or an advisory meant that it was overlooked by developers of AMI MegaRAC BMC, ultimately ending up in products made by Intel and Lenovo.

Lighttpd (pronounced “Lighty”) is an open-source high-performance web server software designed for speed, security, and flexibility, while optimized for high-performance environments without consuming a lot of system resources.

The silent fix for Lighttpd concerns an out-of-bounds read vulnerability that could be exploited to exfiltrate sensitive data, such as process memory addresses, thereby allowing threat actors to bypass crucial security mechanisms like address space layout randomization (ASLR).

“The absence of prompt and important information about security fixes prevents proper handling of these fixes down both the firmware and software supply chains,” the firmware security company said.

The flaws are described below –

  • Out-of-bounds read in Lighttpd 1.4.45 used in Intel M70KLP series firmware
  • Out-of-bounds read in Lighttpd 1.4.35 used in Lenovo BMC firmware
  • Out-of-bounds read in Lighttpd before 1.4.51

Intel and Lenovo have opted not to address the issue as the products incorporating the susceptible version of Lighttpd have hit end-of-life (EoL) status and are no longer eligible for security updates, effectively turning it into a forever-day bug.

The disclosure highlights how the presence of outdated third-party components in the latest version of firmware can traverse the supply chain and pose unintended security risks for end users.

“This is yet another vulnerability that will remain unfixed forever in some products and will present high-impact risk to the industry for a very long time,” Binarly added.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Articles You May Like

Elon Musk predicts smarter-than-humans AI in 2 years. The CEO of China’s Baidu says it’s 10 years away
$9 billion travel tech firm Navan on track to hit profitability this year and ‘not far’ from IPO, CEO says
Samsung Galaxy Z Fold 6 Tipped to Get Less Visible Crease, Redesigned Rear Camera Island
Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam
iPhone SE 4 Tipped to Be Slightly More Expensive Than Its Predecessor