oss-sec mailing list archives
CVE Request: bozohttpd: basic http authentication bypass
From: Salvatore Bonaccorso <carnil () debian org>
Date: Fri, 18 Jul 2014 21:51:22 +0200
Hi Can a CVE be assigned for the following bozohttpd basic http authetication bypass vulnerability? It was fixed in bozohttpd version 20140708. Quoting NetBSD advisory:
Abstract ======== When checking for restricted access via .htpasswd files, bozohttpd fails to properly check for truncation, allowing specially crafted requests to bypass access control without a password. Files of length 10 or more are not affected. Technical Details ================= A call to snprintf() was not properly checking for truncation of a provided user path, allowing a later concatenation of the ".htpasswd" file name to exceed the maximum pathname length. This stops the check for .htpasswd file from working correctly, bypassing the basic HTTP authentication scheme. Files with names longer than ".htpasswd" are not visible as they require at least enough for a valid path to be available.
[1] http://mail-index.netbsd.org/current-users/2014/07/17/msg025287.html [2] https://bugs.debian.org/755197 Thanks in advance, Regards, Salvatore
Current thread:
- CVE Request: bozohttpd: basic http authentication bypass Salvatore Bonaccorso (Jul 18)
- Re: CVE Request: bozohttpd: basic http authentication bypass cve-assign (Jul 18)