CVE-2011-2900: Buffer Overflow
Stack-based buffer overflow in the (1) putdir function in mongoose.c in Mongoose 3.0, (2) putdir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) shttpdputdir function in iodir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2900?
CVE-2011-2900 is considered to have a high severity due to its potential for remote code execution.
How do I fix CVE-2011-2900?
To fix CVE-2011-2900, update Mongoose to version 3.1 or later, Shttpd to version 1.43 or later, or yaSSL Embedded Web Server to version 0.3 or later.
What types of software are affected by CVE-2011-2900?
CVE-2011-2900 affects Mongoose 3.0, Shttpd 1.42, and yaSSL Embedded Web Server 0.2.
What is the exploit method for CVE-2011-2900?
CVE-2011-2900 can be exploited through a stack-based buffer overflow in the put_dir function by sending crafted requests.
Are there any workarounds for CVE-2011-2900?
Temporary workarounds for CVE-2011-2900 may include restricting access to affected services or enabling firewall rules to block untrusted traffic.