Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request: bozohttpd: basic http authentication bypass
From: cve-assign () mitre org
Date: Fri, 18 Jul 2014 18:12:05 -0400 (EDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc

Remote user may access protected files

A call to snprintf() was not properly checking for truncation of
a provided user path, allowing a later concatenation of the
".htpasswd" file name to exceed the maximum pathname length.  This
stops the check for .htpasswd file from working correctly, bypassing
the basic HTTP authentication scheme.

Use CVE-2014-5015.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTyZtdAAoJEKllVAevmvmsRZcH/0TkprRLpsVED9cIjQuujlih
vFHenTAkkk1oJFcu7w3jYFjEddGLXq64t7YYYAs/ElC4c95pZ3rLGnW+XxHqMU6c
ucpYSG7WgyFEHKQeCZOx1Qicm5xxe3kgtpmJwMBz8EiPagWBOIYShpas7qWjeIPE
onsrZ32uBN7ziwQpIIxpxphb/2x1nO8ACN4frgR1BcrMYBuIxxAFEJp86H7jaJND
Aya8y0phZfAEBtS5qpUiVzD9W8bXAxxtXF4+3SAKlNAsziok7SdQv2Ka+2y9nZPh
HX7ZY2KjBifat7hNEtZoNz7P92IqQdIugAJXrDXDTuFJGhSOATgcgDs43//cp7A=
=OARR
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault