Remote buffer overflow vulnerability via defang() in libhttpd.c

[pherris]

"A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c."

httpd 2.23b1: defang() Remote Buffer Overflow Vulnerability

From: http://www.securityfocus.com/bid/8906 :

"A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c.

This issue may allow an attacker to gain unauthorized access to a vulnerable host. Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the web server in order to gain unauthorized access to a vulnerable system.

thttpd versions 2.21 to 2.23b1 have been reported to be prone to this issue, however other versions may be affected as well."

Debian is serving the same version as Ubuntu. thttpd release notes: http://www.acme.com/software/thttpd/#releasenotes . Current version from the author's website: http://www.acme.com/software/thttpd/thttpd-2.25b.tar.gz

[pherris (pherris)]

Sorry. Current version seems to be a _patched_ version of 2.23b1. See: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=216677

[pherris (pherris)]

Current version is a patched version of 2.23b1. See: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=216677