CVE-2003-0899 Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the...
CriticalCVSS 9.8
EPSS 22.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| acme thttpd | >= 2.21, < 2.23 | 2.23 |
| acme thttpd | = 2.23 | No fix listed |
| acme thttpd | = 2.23-b1 | No fix listed |
References
- 20031027 Remote overflow in thttpd exploit mailing-list
- 10092 broken-link patch third-party-advisory vendor-advisory
- 2729 broken-link vdb-entry
- 8906 broken-link exploit patch third-party-advisory vdb-entry
- www.texonet.com broken-link url-repurposed
- thttpd-defang-bo(13530) third-party-advisory vdb-entry
- DSA-396 broken-link vendor-advisory