A vulnerability has been found in thttpd HTTP Server 1.90a/2.04/2.04.31 (Web Server) and classified as critical. This vulnerability affects the function tdate_parse of the component Date Handler. The manipulation as part of a Long String leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Buffer overflow in thttpd HTTP server before 2.04-31 allows remote attackers to execute arbitrary commands via a long date string, which is not properly handled by the tdate_parse function.

The weakness was published 11/16/1999 as 19991116 as not defined advisory (Website). The advisory is shared for download at novell.com. This vulnerability was named CVE-1999-1457. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Vulnerability Center (SBV-126†).

Productinfo

Type

• Web Server

Vendor

• thttpd

Name

• HTTP Server

Version

• 1.90a
• 2.04
• 2.04.31

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion