Home page logo

oss-sec logo oss-sec mailing list archives

CVE Request: bozohttpd: basic http authentication bypass
From: Salvatore Bonaccorso <carnil () debian org>
Date: Fri, 18 Jul 2014 21:51:22 +0200


Can a CVE be assigned for the following bozohttpd basic http
authetication bypass vulnerability? It was fixed in bozohttpd version
20140708. Quoting NetBSD advisory:


When checking for restricted access via .htpasswd files, bozohttpd
fails to properly check for truncation, allowing specially crafted
requests to bypass access control without a password.  Files of
length 10 or more are not affected.

Technical Details

A call to snprintf() was not properly checking for truncation of
a provided user path, allowing a later concatenation of the
".htpasswd" file name to exceed the maximum pathname length.  This
stops the check for .htpasswd file from working correctly, bypassing
the basic HTTP authentication scheme.  Files with names longer than
".htpasswd" are not visible as they require at least enough for a
valid path to be available.

 [1] http://mail-index.netbsd.org/current-users/2014/07/17/msg025287.html
 [2] https://bugs.debian.org/755197

Thanks in advance,


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]