HTTP: Light HTTPD Host Header Vulnerability

This signature detects attempts to exploit a known vulnerability in Light HTTPD; an HTTP server provided with several distributions of Linux. Attackers can use a malformed Host: header value to remotely view files or execute arbitrary code on the target system.

Extended Description

A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c. This issue may allow an attacker to gain unauthorized access to a vulnerable host. Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the web server in order to gain unauthorized access to a vulnerable system. thttpd versions 2.21 to 2.23b1 have been reported to be prone to this issue, however other versions may be affected as well.

Affected Products

Acme_software thttpd

References

BugTraq: 8906

CVE: CVE-2003-0899

Short Name

HTTP:LHTTPD:HOST-DOT-DOT-SLASH

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Light HTTPD Host Header Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?