Mongoose PUT Request Remote Buffer Overflow Vulnerability

Bugtraq ID:	48980
Class:	Boundary Condition Error
CVE:	CVE-2011-2900
Remote:	Yes
Local:	No
Published:	Aug 03 2011 12:00AM
Updated:	Apr 13 2015 10:09PM
Credit:	Nico Golde
Vulnerable:	Mongoose Mongoose 3.8 Mongoose Mongoose 2.8 Mongoose Mongoose 2.4 Mongoose Mongoose 2.11
Not Vulnerable:

Mongoose PUT Request Remote Buffer Overflow Vulnerability

Reports indicate that an exploit code is available for this issue, but Symantec has not confirmed this.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/48980.py

Mongoose PUT Request Remote Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more details.

Mongoose PUT Request Remote Buffer Overflow Vulnerability

References:

• CVE id request: shttpd/mongoose/yassl embedded webserver (Nico Golde)
  
• Exploiting the Ubiquisys/SFR femtocell webserver (wsal/shttpd/mongoose/yassl emb (Nico Golde)
  
• Fixed buffer overflow in put_dir() (Mongoose)
  
• Mongoose Web Server Homepage (Mongoose)