A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.
A flaw was found in BusyBox's httpd. When FEATUREHTTPDGZIP is enabled and a request for /FILE includes an Accept-Encoding: gzip header, httpd serves the pre-compressed FILE.gz if it exists, but authentication rules are matched against the request path only. As a result, a password rule configured for /secret.txt.gz can be bypassed by requesting /secret.txt with Accept-Encoding: gzip, disclosing the contents of the protected file. Only rules naming a specific .gz file are affected; directory rules cover both names.
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
A vulnerability was found in the BusyBox httpd Basic Authentication handler (networking/httpd.c) when configured to authenticate against system passwords. A missing else clause after a failed getspnamr() call creates an observable behavioral difference between authentication failures for existing and non-existing system users. Existing user with wrong password: connection reset. Non-existing user: clean HTTP 401.