Acme Labs thttpd HTPasswd Multiple Vulnerabilities
BID:16972
Info
Acme Labs thttpd HTPasswd Multiple Vulnerabilities
| Bugtraq ID: | 16972 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 06 2006 12:00AM |
| Updated: | Mar 09 2006 08:20AM |
| Credit: | Larry Cashdollar <[email protected]> discovered these issues. |
| Vulnerable: |
Acme thttpd 2.24 Acme thttpd 2.23 b1 Acme thttpd 2.22 Acme thttpd 2.21 b Acme thttpd 2.21 Acme thttpd 2.20 c Acme thttpd 2.20 b Acme thttpd 2.20 Acme thttpd 2.19 Acme thttpd 2.18 Acme thttpd 2.17 Acme thttpd 2.16 Acme thttpd 2.15 Acme thttpd 2.14 Acme thttpd 2.13 Acme thttpd 2.12 Acme thttpd 2.11 Acme thttpd 2.10 Acme thttpd 2.0.9 Acme thttpd 2.0.8 Acme thttpd 2.0.7 beta 0.4 Acme thttpd 2.0.7 Acme thttpd 2.0.6 Acme thttpd 2.0.5 Acme thttpd 2.0.4 Acme thttpd 2.0.3 Acme thttpd 2.0.2 Acme thttpd 2.0.1 Acme thttpd 2.0 Acme thttpd 1.95 Acme thttpd 1.90 a Acme thttpd 1.0 .x Acme thttpd 1.0 Acme thttpd 2.25 b Acme thttpd 2.1x |
| Not Vulnerable: | |
Discussion
Acme Labs thttpd HTPasswd Multiple Vulnerabilities
Multiple buffer-overflow vulnerabilities exist in the 'htpasswd' utility included with thttpd. These vulnerabilities occur because the utility fails to do proper bounds checking of user-supplied input before copying it into insufficiently sized memory buffers.
The 'htpasswd' utility is also susceptible to a command-execution vulnerability, because it fails to properly sanitize user-supplied input.
Since the program is not installed setuid by default, this vulnerability does not normally have a local impact. However, this may be a concern if the software is called from a CGI script or if it is used in conjunction with 'sudo' or other such privilege-escalation utilities. An attacker may be able to supply malformed data to the program, which will cause the overflow to occur.
Since the 'htpasswd' utility in thttpd was originally copied from Apache, these issues may be similar to the one described in BID 13777, Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability.
Version 2.25b is vulnerable to these issues; prior versions are also likely affected.
Multiple buffer-overflow vulnerabilities exist in the 'htpasswd' utility included with thttpd. These vulnerabilities occur because the utility fails to do proper bounds checking of user-supplied input before copying it into insufficiently sized memory buffers.
The 'htpasswd' utility is also susceptible to a command-execution vulnerability, because it fails to properly sanitize user-supplied input.
Since the program is not installed setuid by default, this vulnerability does not normally have a local impact. However, this may be a concern if the software is called from a CGI script or if it is used in conjunction with 'sudo' or other such privilege-escalation utilities. An attacker may be able to supply malformed data to the program, which will cause the overflow to occur.
Since the 'htpasswd' utility in thttpd was originally copied from Apache, these issues may be similar to the one described in BID 13777, Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability.
Version 2.25b is vulnerable to these issues; prior versions are also likely affected.
Exploit / POC
Acme Labs thttpd HTPasswd Multiple Vulnerabilities
The command-execution vulnerability does not require an exploit.
Currently we are not aware of any exploits for the buffer overflow issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
The command-execution vulnerability does not require an exploit.
Currently we are not aware of any exploits for the buffer overflow issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
Acme Labs thttpd HTPasswd Multiple Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]
References
Acme Labs thttpd HTPasswd Multiple Vulnerabilities
References:
References:
- [THTTPD] htpasswd.c security issues. ("Larry Cashdollar"
- Re: [THTTPD] htpasswd.c security issues. (Jef Poskanzer
- thttpd Homepage (Acme)
- htpasswd bufferoverflow and command execution in thttpd-2.25b. ("Larry Cashdollar"