PT-2017-11424 · Sthttpd · Thttpd

Alpire · Publicado 2017-06-29 · Atualizado 2024-07-19 · CVE-2017-10671

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sthttpd versions prior to 2.27.1

Description The issue is related to a Heap-based Buffer Overflow in the de dotdot function in libhttpd.c, which can be exploited by remote attackers using a crafted filename. This can cause a denial of service, resulting in the daemon crashing, or possibly have other unspecified impacts.

Recommendations For versions prior to 2.27.1, update to version 2.27.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the de dotdot function in libhttpd.c to minimize the risk of exploitation.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2017-10671

Produtos afetados

Thttpd

Referências · 7

• https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660 · Correção
• https://github.com/blueness/sthttpd/releases/tag/v2.27.1 · Correção
• https://t.me/cvenotify/9552 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2017/06/15/9 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-10671 · Nota de Segurança
• https://t.me/cvenotify/86723 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-10671 · Aviso do Fabricante