SHTTPD Remote Buffer Overflow Vulnerability

Bugtraq ID:	20393
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 06 2006 12:00AM
Updated:	Oct 18 2006 10:59PM
Credit:	Discovery is credited to skOd.
Vulnerable:	SHTTPD SHTTPD 1.34
Not Vulnerable:	SHTTPD SHTTPD 1.35

SHTTPD Remote Buffer Overflow Vulnerability

SHTTPD is prone to a remote buffer-overflow vulnerability.

Specifically, the issue presents itself as an error in the handling of HTTP POST requests.

SHTTPD 1.34 and prior are reported vulnerable; other versions may be affected as well.

SHTTPD Remote Buffer Overflow Vulnerability

There is a proof of concept available.

• /data/vulnerabilities/exploits/20393_http_post_overflow.txt

SHTTPD Remote Buffer Overflow Vulnerability

Solution:
An updated version that addresses this issue is available. Please see the vendor references for more information.


SHTTPD SHTTPD 1.34

• SHTTPD Simple HTTPD version 1.35
  http://sourceforge.net/project/showfiles.php?group_id=126090

SHTTPD Remote Buffer Overflow Vulnerability

References:

• SHTTPD Buffer Overflow (POST) (skOd)
  
• SHTTPD Homepage (SHTTPD)