PT-2006-2106 · Apache+1 · Htpasswd+1
Michael Engert
·
Published
2006-03-09
·
Updated
2025-01-16
·
CVE-2006-1078
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Acme thttpd version 2.25b
htpasswd (affected versions not specified)
Description
Multiple buffer overflows in htpasswd might allow local users to gain privileges via a long command line argument and a long line in a file. This issue is potentially significant if htpasswd is used with sudo privileges or accessed remotely in certain configurations.
Recommendations
For Acme thttpd version 2.25b, consider restricting access to the htpasswd utility until a patch is available.
As a temporary workaround, avoid using long command line arguments and long lines in files with htpasswd.
Restrict access to htpasswd to minimize the risk of exploitation, especially if it is used with sudo privileges or accessed remotely.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Acme Thttpd
Htpasswd