PT-2007-7262 · Sergey Lyubka · Shttpd

Luigi Auriemma · Publicado 2007-12-17 · Atualizado 2018-10-15 · CVE-2007-6405

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sergey Lyubka Simple HTTPD (shttpd) versions 1.38 and earlier

Description The issue allows remote attackers to download arbitrary CGI programs or scripts via a specially crafted URI. This can be achieved by appending certain characters to the URI, including (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f.

Recommendations For versions 1.38 and earlier, update to a version later than 1.38 to resolve the issue. As a temporary workaround, consider restricting access to CGI programs or scripts to minimize the risk of exploitation. Avoid using the affected URI patterns in the shttpd server until the issue is resolved.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-6405

Produtos afetados

Shttpd

Referências · 8

• 🔥 https://exploit-db.com/exploits/4700 · Exploit
• 🔥 http://aluigi.altervista.org/adv/shttpd-adv.txt · Exploit
• 🔥 http://securityfocus.com/bid/26768 · Exploit
• 🔥 http://sourceforge.net/mailarchive/forum.php?thread_name=20071203130540.6e482c20.aluigi%40autistici.org&forum_name=shttpd-general · Exploit
• http://osvdb.org/44119 · Nota
• http://securityreason.com/securityalert/3457 · Nota
• http://securityfocus.com/archive/1/484761/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6405 · Nota de Segurança