Unscored severity · published Jul 24, 2014
CVE-2014-5015
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP…
–
CVSS
1.7%
EPSS
No
On KEV
Description
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bozohttpd · Eterna
through 20140201; 19990519; 20000421; 20000426; 20000427; 20000815; +30 more · source: NVD
NE
Netbsd · Netbsd
5.1; 5.2; 6.0; 6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5015
seclists.org
http://seclists.org/oss-sec/2014/q3/180
Patch
http://www.eterna.com.au/bozohttpd/
www.eterna.com.au
http://www.eterna.com.au/bozohttpd/CHANGES
www.osvdb.org
http://www.osvdb.org/109283
www.securityfocus.com
http://www.securityfocus.com/bid/68752
More from Bozohttpd
–
CVE-2010-2320
bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple…
–
CVE-2010-2195
bozotic HTTP server (aka bozohttpd) 20090522 through 20100512 allows attackers to cause a denial of service via vectors related to a "wrong code generation interaction with GCC."