PT-2010-3906 · Bozotic · Bozohttpd

Claudio Clemenson · Published 2010-08-02 · Updated 2017-08-17 · CVE-2010-2320

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bozotic HTTP server (aka bozohttpd) versions prior to 20100621

Description The issue allows remote attackers to list the contents of home directories and determine the existence of user accounts via multiple requests for URIs beginning with /~ sequences.

Recommendations For versions prior to 20100621, update to a version released after 20100621 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2320

Affected Products

Bozohttpd

References · 7

• 🔥 https://bugs.launchpad.net/ubuntu/+source/bozohttpd/+bug/582473 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590298 · Exploit
• http://secunia.com/advisories/40737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2320 · Security Note
• http://eterna.com.au/bozohttpd/CHANGES · Note
• http://security-tracker.debian.org/tracker/CVE-2010-2320 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60812 · Note