EmbedThis GoAhead Webserver 2.1.8 Nonce websda.c onceuponatimeinparadise entropy

Summaryinfo

A vulnerability was found in EmbedThis GoAhead Webserver 2.1.8. It has been classified as problematic. Affected is an unknown function of the file websda.c of the component Nonce Handler. Performing a manipulation of the argument onceuponatimeinparadise results in entropy. This vulnerability is known as CVE-2021-41615. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in EmbedThis GoAhead Webserver 2.1.8 (Web Server). This affects an unknown code block of the file websda.c of the component Nonce Handler. The manipulation of the argument onceuponatimeinparadise with an unknown input leads to a entropy vulnerability. CWE is classifying the issue as CWE-331. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. This is going to have an impact on confidentiality. The summary by CVE is:

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.

The weakness was published 08/09/2022. It is possible to read the advisory at devel.rtems.org. This vulnerability is uniquely identified as CVE-2021-41615 since 09/25/2021. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• EmbedThis

Name

• GoAhead Webserver

Version

• 2.1.8

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion