CVE-2011-2900 Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function....
HighCVSS 7.5
EPSS 13.3%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shttpd | = 1.42 | No fix listed |
| valenok mongoose | = 3.0 | No fix listed |
| yasslews | = 0.2 | No fix listed |
References
- FEDORA-2011-11636 vendor-advisory
- FEDORA-2011-11823 vendor-advisory
- FEDORA-2011-11825 vendor-advisory
- 45464 third-party-advisory vendor-advisory
- 45902 third-party-advisory
- 8337 third-party-advisory
- [oss-security] 20110803 CVE id request: shttpd/mongoose/yassl embedded webserver mailing-list patch
- [oss-security] 20110803 Re: CVE id request: shttpd/mongoose/yassl embedded webserver mailing-list patch
- 48980 vdb-entry
- code.google.com patch
- mongoose-put-bo(68991) vdb-entry