PT-2014-6247 · Bozotic · Bozohttpd

Publicado 2014-07-24 · Atualizado 2017-08-29 · CVE-2014-5015

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bozotic HTTP server (aka bozohttpd) versions before 20140708

Description The issue allows remote attackers to bypass the HTTP authentication scheme and access restrictions. This is achieved by exploiting the path truncation when checking .htpasswd restrictions, enabling access to otherwise restricted areas via a long path.

Recommendations For versions before 20140708, update to version 20140708 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-5015

DLA-490-1

Produtos afetados

Bozohttpd

Referências · 13

• https://cve.org/CVERecord?id=CVE-2014-5015 · Nota de Segurança
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc · Nota
• http://osvdb.org/109283 · Nota
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5015 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94751 · Nota
• http://eterna.com.au/bozohttpd/CHANGES · Nota
• https://marc.info/?l=oss-security&m=140572157701095&w=2 · Nota
• http://seclists.org/oss-sec/2014/q3/180 · Nota
• http://securityfocus.com/bid/68752 · Nota
• http://eterna.com.au/bozohttpd · Correção
• https://ubuntu.com/security/CVE-2014-5015 · Aviso do Fabricante