PT-2007-7262 · Sergey Lyubka · Shttpd

Luigi Auriemma · Published 2007-12-17 · Updated 2018-10-15 · CVE-2007-6405

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sergey Lyubka Simple HTTPD (shttpd) versions 1.38 and earlier

Description The issue allows remote attackers to download arbitrary CGI programs or scripts via a specially crafted URI. This can be achieved by appending certain characters to the URI, including (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f.

Recommendations For versions 1.38 and earlier, update to a version later than 1.38 to resolve the issue. As a temporary workaround, consider restricting access to CGI programs or scripts to minimize the risk of exploitation. Avoid using the affected URI patterns in the shttpd server until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-6405

Affected Products

Shttpd

References · 8

• 🔥 https://exploit-db.com/exploits/4700 · Exploit
• 🔥 http://aluigi.altervista.org/adv/shttpd-adv.txt · Exploit
• 🔥 http://securityfocus.com/bid/26768 · Exploit
• 🔥 http://sourceforge.net/mailarchive/forum.php?thread_name=20071203130540.6e482c20.aluigi%40autistici.org&forum_name=shttpd-general · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6405 · Security Note
• http://osvdb.org/44119 · Note
• http://securityreason.com/securityalert/3457 · Note
• http://securityfocus.com/archive/1/484761/100/0/threaded · Note