[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201407182212.s6IMC5JT004797@linus.mitre.org>
Date: Fri, 18 Jul 2014 18:12:05 -0400 (EDT)
From: cve-assign@...re.org
To: carnil@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: bozohttpd: basic http authentication bypass
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc
> Remote user may access protected files
> A call to snprintf() was not properly checking for truncation of
> a provided user path, allowing a later concatenation of the
> ".htpasswd" file name to exceed the maximum pathname length. This
> stops the check for .htpasswd file from working correctly, bypassing
> the basic HTTP authentication scheme.
Use CVE-2014-5015.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTyZtdAAoJEKllVAevmvmsRZcH/0TkprRLpsVED9cIjQuujlih
vFHenTAkkk1oJFcu7w3jYFjEddGLXq64t7YYYAs/ElC4c95pZ3rLGnW+XxHqMU6c
ucpYSG7WgyFEHKQeCZOx1Qicm5xxe3kgtpmJwMBz8EiPagWBOIYShpas7qWjeIPE
onsrZ32uBN7ziwQpIIxpxphb/2x1nO8ACN4frgR1BcrMYBuIxxAFEJp86H7jaJND
Aya8y0phZfAEBtS5qpUiVzD9W8bXAxxtXF4+3SAKlNAsziok7SdQv2Ka+2y9nZPh
HX7ZY2KjBifat7hNEtZoNz7P92IqQdIugAJXrDXDTuFJGhSOATgcgDs43//cp7A=
=OARR
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
