PT-2017-11424 · Sthttpd · Thttpd

Alpire · Published 2017-06-29 · Updated 2024-07-19 · CVE-2017-10671

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sthttpd versions prior to 2.27.1

Description The issue is related to a Heap-based Buffer Overflow in the de dotdot function in libhttpd.c, which can be exploited by remote attackers using a crafted filename. This can cause a denial of service, resulting in the daemon crashing, or possibly have other unspecified impacts.

Recommendations For versions prior to 2.27.1, update to version 2.27.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the de dotdot function in libhttpd.c to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2017-10671

Affected Products

Thttpd

References · 7

• https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660 · Patch
• https://github.com/blueness/sthttpd/releases/tag/v2.27.1 · Patch
• http://openwall.com/lists/oss-security/2017/06/15/9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-10671 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10671 · Vendor Advisory
• https://t.me/cvenotify/9552 · Telegram Post
• https://t.me/cvenotify/86723 · Telegram Post