Vulnerability in Eterna Bozohttpd
CVE-2014-5015
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
EPSS: 0.017 (75.4th percentile) — read the EPSS interpretation.
Affected products
- Eterna Bozohttpd — versions 19990519, 20000421, 20000426
- Netbsd — versions 5.1, 5.2, 6.0
- N/a — versions n/a
Weakness classification (CWE)
References
- security@debian.org (vdb-entry, x_refsource_BID)
- security@debian.org (x_refsource_CONFIRM)
- security@debian.org (x_refsource_OSVDB, vdb-entry)
- security@debian.org (x_refsource_CONFIRM, Patch)
- security@debian.org (vdb-entry, x_refsource_XF)
- security@debian.org (mailing-list, x_refsource_MLIST)