CVE:CVE-2014-2323
CNNVD:CNNVD-201403-290
lighttpd是德国软件开发者Jan Kneschke所研发的一款开源的Web服务器，它的主要特点是仅需少量的内存及CPU资源即可达到同类网页服务器的性能。
lighttpd 1.4.34及之前版本中的mod_mysql_vhost.c文件存在SQL注入漏洞。远程攻击者可借助特制的主机名利用该漏洞执行任意SQL命令。
solution:Upgrade lighttpd lighttpd to a higher version than 1.4.35,and avoid the version (,1.4.35); Upgrade debian debian_linux to a higher version than 6.0,7.0,8.0,and avoid the version 6.0,7.0,8.0; Upgrade opensuse opensuse to a higher version than 11.4,12.3,13.1,and avoid the version 11.4,12.3,13.1; Upgrade suse linux_enterprise_high_availability_extension to a higher version than 11:sp3,and avoid the version 11:sp3; Upgrade suse linux_enterprise_software_development_kit to a higher version than 11:sp3,and avoid the version 11:sp3