BID:8924

Acme thttpd/mini_httpd Virtual Hosting File Disclosure Vulnerability

Info

Acme thttpd/mini_httpd Virtual Hosting File Disclosure Vulnerability

Bugtraq ID:	8924
Class:	Access Validation Error
CVE:	CVE-2002-1562
Remote:	Yes
Local:	No
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 11:56PM
Credit:	Discovery is credited to Marcus Breiing.
Vulnerable:	Acme Software mini_httpd 1.16 Acme Software mini_httpd 1.15 c Acme Software mini_httpd 1.15 b Acme Software mini_httpd 1.15 Acme Software mini_httpd 1.14 Acme Software mini_httpd 1.13 Acme Software mini_httpd 1.12 Acme Software mini_httpd 1.11 Acme Software mini_httpd 1.10 0 Acme Software mini_httpd 1.0 1 Acme Software mini_httpd 1.0 0 Acme thttpd 2.23 b1 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1 Acme thttpd 2.22 Acme thttpd 2.21 b + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha Acme thttpd 2.21 Acme thttpd 2.20 c + SuSE Linux 8.0 Acme thttpd 2.20 b + SuSE Linux 7.3 Acme thttpd 2.20 Acme thttpd 2.19 Acme thttpd 2.18 Acme thttpd 2.17 Acme thttpd 2.16 Acme thttpd 2.15 - SuSE Linux 6.4 Acme thttpd 2.14 Acme thttpd 2.13 Acme thttpd 2.12 Acme thttpd 2.11 Acme thttpd 2.10 Acme thttpd 2.0.9 Acme thttpd 2.0.8 Acme thttpd 2.0.7 Acme thttpd 2.0.6 Acme thttpd 2.0.5 + FREESCO FREESCO 0.3.2 + FREESCO FREESCO 0.3.1 + FREESCO FREESCO 0.3 .0 + FREESCO FREESCO 0.2.7 Acme thttpd 2.0.4 - SuSE Linux 6.3 - SuSE Linux 6.2 Acme thttpd 2.0.3 Acme thttpd 2.0.2 Acme thttpd 2.0.1 Acme thttpd 2.0 Acme thttpd 1.95 Acme thttpd 1.90 a Acme thttpd 1.0

Not Vulnerable:	Acme Software mini_httpd 1.18 Acme thttpd 2.24

Discussion

Acme thttpd/mini_httpd Virtual Hosting File Disclosure Vulnerability

A file disclosure vulnerability has been reported in Acme thttpd and mini_httpd that is exposed when virtual hosting is enabled. By submitting a directory traversal sequence in the Host: header field of an HTTP request, it is possible to gain unauthorized access to files on the system. If chroot is used, this will disclose the contents of directories under the chroot. This could allow access to other files on the system if chroot is not used.

Exploit / POC

Acme thttpd/mini_httpd Virtual Hosting File Disclosure Vulnerability

There is no exploit required.

Solution / Fix

Acme thttpd/mini_httpd Virtual Hosting File Disclosure Vulnerability

Solution:
SuSE has released an advisory (SuSE-SA:2003:044) to address this issue in SuSE Linux platforms. Affected users are advised to apply fixes as soon as possible. Further information regarding obtaining and applying these fixes can be found in the referenced advisory.

Debian has released an advisory (DSA 396-1) and fixes to address this issue in thttpd.

Conectiva has released a security advisory (CLA-2003:777) which contains fixes to address this issue. Users are advised to upgrade as soon as possible.

This issue has been addressed in thttpd 2.24 and mini_httpd 1.18.

Acme Software mini_httpd 1.0 0