# MA-236.062010: MyCERT Alert - Critical Vulnerability in LiteSpeed Web Server

**Date:** 14 Jun 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-236.062010  
**Advisory ID:** MA-236.062010

---

**1.0 Introduction**
A critical vulnerability has been identified in the LiteSpeed Web Server. The vulnerability, if successfully exploited could potentially cause source code and sensitive information disclosure. This vulnerability occurs because Litespeed Web Server fails to adequately sanitize user-supplied input.
MyCERT is aware that the exploit is available on the Internet at the time of the publication of this advisory.
**2.0 Impact**
An attacker can gather sensitive information (database connection strings, application logic) by analyzing the source code. This information can be used to conduct further attacks.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Litespeed Web Server 4.0.14 and earlier version
**4.0 Recommendations**
MyCERT recommends system administrator of this application to upgrade to version 4.0.15.
The update can be obtained via this URL:
<http://www.litespeedtech.com/litespeed-web-server-downloads.html>
If you are unable to upgrade at this moment, please add the following mod\_security 'Request Filter' rules to block the exploit:
*Name : NULLBYTE
Action: deny,log
Eabled: yes
Rules Definition: SecRule REQUEST\_URI "\x00"*
If you don't have mod\_security install, please add the following htaccess to block the exploit:
*RedirectMatch 403 (.\*)\x00\.txt*
MyCERT advises users of this product to keep themselves updated with the latest security announcements by the vendor.
MyCERT can be reached through the following channels for further assistance:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#016c7862647375416c78626473752f6e73662f6c78)
Phone : +603 89926969 or 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL><COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.litespeedtech.com/support/forum/showthread.php?s=f41f5204cb6ac14e4f22c667b3d5cb7b&t=4078>
- <http://www.litespeedtech.com/litespeed-web-server-release-log.html>
- <http://my0d.my/forum/thread-215-post-1024.html#pid1024>