Title: Acme THTTPD/Mini_HTTPD File Disclosure Vulnerability
Severity: HIGH
Description:
Acme THTTPD and Mini_HTTPD are both small web servers and will run on Freebsd, SunOs, Solaris, Linux, and other Unix operating systems. They are freely available and maintained by Acme Laboratories.
Both of these programs are prone to an issue which may allow a remote attacker to make a specially crafted web request which is capable of displaying arbitrary files on a vulnerable host.
The root of this problem is in how these programs handle file requests. If a '/' is appended to end of a request for an existing file, this will cause the file to be displayed. Files that exist in protected directories or that are marked 403(but not world-readable) may be retrieved in this manner. This issue may be taken advantage of to retrieve '.htpasswd' files.
For example:
http://host/protected-dir/.htpasswd/ (Notice the / on the end)
It should be noted that THTTPD Secure Webserver is only prone to this issue when the 'chroot' option is enabled. Mini_HTTPD is affected regardless of any settings.
Though the vendor has acknowledged and patched the problem, there have been reports that some environments may not be vulnerable to this issue. For example, systems running Acme THTTPD 2.20b on FreeBSD and some Linux distributions.
Affected Products:
- Acme mini_httpd 1.10.00
- Acme mini_httpd 1.11.0
- Acme mini_httpd 1.12.0
- Acme mini_httpd 1.13.0
- Acme mini_httpd 1.14.0
- Acme mini_httpd 1.15.0
- Acme mini_httpd 1.15.0b
- Acme mini_httpd 1.15.0c
- Acme thttpd 1.90.0a
- Acme thttpd 1.95.0
- Acme thttpd 2.0.0
- Acme thttpd 2.0.1
- Acme thttpd 2.0.2
- Acme thttpd 2.0.3
- Acme thttpd 2.0.4
- Acme thttpd 2.0.5
- Acme thttpd 2.0.6
- Acme thttpd 2.0.7
- Acme thttpd 2.0.8
- Acme thttpd 2.0.9
- Acme thttpd 2.10.0
- Acme thttpd 2.11.0
- Acme thttpd 2.12.0
- Acme thttpd 2.13.0
- Acme thttpd 2.14.0
- Acme thttpd 2.15.0
- Acme thttpd 2.16.0
- Acme thttpd 2.17.0
- Acme thttpd 2.18.0
- Acme thttpd 2.19.0
- Acme thttpd 2.20.0
- Acme thttpd 2.20.0b
- Acme thttpd 2.20.0c
- Acme thttpd 2.21.0
- Acme thttpd 2.21.0b
- Conectiva Linux 9.0.0
- Debian Linux 3.0.0 alpha
- Debian Linux 3.0.0 arm
- Debian Linux 3.0.0 hppa
- Debian Linux 3.0.0 ia-32
- Debian Linux 3.0.0 ia-64
- Debian Linux 3.0.0 m68k
- Debian Linux 3.0.0 mips
- Debian Linux 3.0.0 mipsel
- Debian Linux 3.0.0 ppc
- Debian Linux 3.0.0 s/390
- Debian Linux 3.0.0 sparc
- FREESCO FREESCO 0.2.7
- FREESCO FREESCO 0.3.0.0
- FREESCO FREESCO 0.3.1
- FREESCO FREESCO 0.3.2
- S.u.S.E. Linux 7.3.0
- S.u.S.E. Linux 8.0.0
References:
- Acme: Acme software thttpd
- Acme: mini_httpd Product Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
