thttpd contains a flaw that may allow a malicious local user to execute privileged commands. The issue is triggered when a user calls the 'htpasswd' utility but supplies arbitrary commands along with a username to be added to a password file. It is possible that the flaw may allow the user to bypass the required authentication and execute arbitrary programs with privileged access.
Classification
Location:
Local Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Public
Technical
The htpasswd program is not set with SUID/SGID by default and can not be leveraged for additional privileges as a result of a default installation. This vulnerability only manifests if an administrator adds SUID or SGID privileges to the program, or if another program invokes it with increased privileges.
Solution
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
gmail.com -
Personal Page
