Hackers can use the Lighttpd vulnerability to focus on BMCs

Lighttpd is a well-liked open-source net server. A number of producers use it for his or her instruments and merchandise as a result of it’s versatile, quick, environment friendly, and compliant. Moreover, it holds properly in high-performance environments. Sadly, Lighttpd has an unsolved vulnerability that impacts over 2000 gadgets made by Intel, Lenovo, Supermicro, and American Megatrends Worldwide (AMI).

As well as, the Lighttpd vulnerability impacts baseboard administration controllers (BMCs) from Duluth, Georgia-based AMI, or Taiwan-based AETN.

What are the BMCs for?

The issue may turn into severe as a result of BMCs are liable for permitting cloud facilities and their prospects to handle servers remotely. Additionally, they work even should you flip off your system. Thus, menace actors may remotely invade them utilizing the Lighttpd vulnerability to entry and management them anytime.

Lighttpd builders mounted the issue in 2018 with out specifying it solely within the patch. On prime of that, they didn’t assign a CVE to it. Thus, producers continued utilizing the outdated model of the open-source net server.

Hackers can exploit the Lighttpd vulnerability and entry the learn reminiscence of a server. From there, they’ll bypass security methods equivalent to ASLR (Deal with area structure randomization).

Intel and Levenovo is not going to launch a patch to repair the difficulty. As well as, they declare that they not assist the {hardware} that’s probably susceptible to it. Nonetheless, the opposite variations are going to stay in danger ceaselessly. For instance, Supermico remains to be counting on Lighttpd. So, take into account contacting the producer for a doable repair.

Thankfully, the Lighttpd vulnerability alone just isn’t extreme as a result of cybercriminals want a working exploit to make use of it. On prime of that, it’s essential allow the BMCs solely once you want them. Afterward, you need to fastidiously lock them as a result of they permit the management of servers with HTTP requests.

In the end, you possibly can handle the Lighttpd vulnerability with some additional care. In spite of everything, should you use Intel or Lenovo {hardware}, there received’t be a repair. Additionally, you’ll find the vulnerability in methods utilizing Lighttpd variations 1.4.35, 1.4.45, and 1.4.51. Nonetheless, you shouldn’t fear a lot about it as a result of the difficulty persevered for six years, and no person did something about it.

What are your ideas? Ought to Intel and Lenovo do one thing in regards to the subject? Tell us within the feedback.

Sebastian is a content material author with a want to study every part new about AI and gaming. So, he spends his time writing prompts on numerous LLMs to grasp them higher. Moreover, Sebastian has expertise fixing performance-related issues in video video games and is aware of his manner round Home windows. Additionally, he’s keen on something associated to quantum expertise and turns into a analysis freak when he desires to study extra.