CVE-2007-6405: Infoleak

Published Dec 17, 2007

Updated

Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.

Affected Software

3 affected components

shttpd shttpd=1.34

shttpd shttpd=1.38

shttpd shttpd=1.35

Event History

Dec 17, 2007

CVE Published

06:46 PM

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-6405?

CVE-2007-6405 is considered a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2007-6405?

To fix CVE-2007-6405, upgrade to shttpd version 1.39 or later where this vulnerability is addressed.

What types of attacks are possible with CVE-2007-6405?

CVE-2007-6405 allows attackers to download arbitrary CGI scripts by manipulating the URI.

Which versions of shttpd are affected by CVE-2007-6405?

CVE-2007-6405 affects shttpd versions 1.34, 1.35, and 1.38.

Is CVE-2007-6405 specific to any operating system?

Yes, CVE-2007-6405 specifically affects the Windows versions of shttpd.