News
Vigil@nce - NetBSD: information disclosure via bozohttpd
August 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can bypass access restrictions in bozohttpd of NetBSD,
in order to obtain sensitive information.
Impacted products: NetBSD
Severity: 2/4
Creation date: 18/07/2014
DESCRIPTION OF THE VULNERABILITY
The NetBSD product offers a web service based on bozohttpd.
A ".htpasswd" file is used to filter the access to the directory
where it is located. However, an attacker can use an access path
especially build to be too long, so "path/.htpasswd" is truncated,
and then ignored.
An attacker can therefore bypass access restrictions in bozohttpd
of NetBSD, in order to obtain sensitive information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/NetBSD-information-disclosure-via-bozohttpd-15071
