Lighttpd

crypt() can fail and with current glibc it fails much often (when salt with unsupported algorithm is passed) or when nss module is not available (in case when glibc built with nss support).

Unfortunately lighttpd doesn't check crypt restult and for example version 1.4.xx simply segfaults in such case.

Anyone with passwd file (used by lighttpd) access can force server segfault in such case.

diff -urN lighttpd-1.4.32.org/src/http_auth.c lighttpd-1.4.32/src/http_auth.c
--- lighttpd-1.4.32.org/src/http_auth.c 2012-05-17 11:29:24.000000000 +0200
+++ lighttpd-1.4.32/src/http_auth.c     2013-06-05 19:58:07.828450230 +0200
@@ -688,6 +688,8 @@
                salt[salt_len] = '\0';

                crypted = crypt(pw, salt);
+               if (NULL == crypted)
+                       return -1;

                if (0 == strcmp(password->ptr, crypted)) {
                        return 0;