Vulnerability in Cherokee Httpd
CVE-2004-1097
Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.
EPSS: 0.056 (92.0th percentile) — read the EPSS interpretation.
Affected products
- Cherokee Cherokee_httpd — versions 0.1, 0.1.5, 0.1.6
- N/a — versions n/a
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (vendor-advisory, Patch, x_refsource_GENTOO, Vendor Advisory)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (x_refsource_MISC)