sthttpd up to 2.27.0 libhttpd.c de_dotdot Filename memory corruption

Summaryinfo

A vulnerability was found in sthttpd up to 2.27.0 and classified as critical. Affected is the function de_dotdot of the file libhttpd.c. Executing a manipulation as part of Filename can lead to memory corruption. The identification of this vulnerability is CVE-2017-10671. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in sthttpd up to 2.27.0 (Web Server). It has been declared as critical. This vulnerability affects the function de_dotdot of the file libhttpd.c. The manipulation as part of a Filename leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted filename.

The bug was discovered 06/15/2017. The weakness was shared 06/29/2017 (Website). The advisory is shared for download at openwall.com. This vulnerability was named CVE-2017-10671 since 06/28/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.27.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Server

Name

• sthttpd

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion