CVE-2017-10671 - Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows r

CVE-2017-10671

Summary

Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename.

References

https://github.com/blueness/sthttpd/releases/tag/v2.27.1
https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660
http://www.openwall.com/lists/oss-security/2017/06/15/9

Vulnerable Configurations

cpe:2.3:a:sthttpd_project:sthttpd:-:*:*:*:*:*:*:*
cpe:2.3:a:sthttpd_project:sthttpd:-:*:*:*:*:*:*:*
cpe:2.3:a:sthttpd_project:sthttpd:2.27.1:*:*:*:*:*:*:*
cpe:2.3:a:sthttpd_project:sthttpd:2.27.1:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 19-07-2024 - 13:05)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

misc

http://www.openwall.com/lists/oss-security/2017/06/15/9
https://github.com/blueness/sthttpd/commit/c0dc63a49d8605649f1d8e4a96c9b468b0bff660
https://github.com/blueness/sthttpd/releases/tag/v2.27.1

Last major update

19-07-2024 - 13:05

Published

29-06-2017 - 08:29

Last modified

19-07-2024 - 13:05