REDHAT-BUG-2531348: Low severity BusyBox httpd vulnerability
A vulnerability was found in the BusyBox httpd Basic Authentication handler (networking/httpd.c) when configured to authenticate against system passwords. A missing else clause after a failed getspnamr() call creates an observable behavioral difference between authentication failures for existing and non-existing system users. Existing user with wrong password: connection reset. Non-existing user: clean HTTP 401.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this user-enumeration issue?
BusyBox httpd deployments are affected when configured to authenticate Basic Authentication users against system passwords. The observable difference occurs in the system-password lookup path.
What does an attacker need to exploit the issue?
An attacker needs to attempt HTTP Basic Authentication with candidate usernames and observe the server response behavior. A wrong password for an existing system user causes a connection reset, while a nonexistent user receives an HTTP 401 response.
What information can an attacker obtain?
The differing responses can reveal whether a queried username exists as a system user. The provided information does not indicate that the issue directly exposes passwords or grants authentication bypass.