oss-sec mailing list archives
Re: CVE Request: bozohttpd: basic http authentication bypass
From: cve-assign () mitre org
Date: Fri, 18 Jul 2014 18:12:05 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc
Remote user may access protected files
A call to snprintf() was not properly checking for truncation of a provided user path, allowing a later concatenation of the ".htpasswd" file name to exceed the maximum pathname length. This stops the check for .htpasswd file from working correctly, bypassing the basic HTTP authentication scheme.
Use CVE-2014-5015. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTyZtdAAoJEKllVAevmvmsRZcH/0TkprRLpsVED9cIjQuujlih vFHenTAkkk1oJFcu7w3jYFjEddGLXq64t7YYYAs/ElC4c95pZ3rLGnW+XxHqMU6c ucpYSG7WgyFEHKQeCZOx1Qicm5xxe3kgtpmJwMBz8EiPagWBOIYShpas7qWjeIPE onsrZ32uBN7ziwQpIIxpxphb/2x1nO8ACN4frgR1BcrMYBuIxxAFEJp86H7jaJND Aya8y0phZfAEBtS5qpUiVzD9W8bXAxxtXF4+3SAKlNAsziok7SdQv2Ka+2y9nZPh HX7ZY2KjBifat7hNEtZoNz7P92IqQdIugAJXrDXDTuFJGhSOATgcgDs43//cp7A= =OARR -----END PGP SIGNATURE-----
Current thread:
- CVE Request: bozohttpd: basic http authentication bypass Salvatore Bonaccorso (Jul 18)
- Re: CVE Request: bozohttpd: basic http authentication bypass cve-assign (Jul 18)