CVE-2014-5015 Auth bypass in n/a

Medium 5.0 Published 24 Jul 2014 Updated 6 Aug 2024

Remote attackers can bypass HTTP authentication and access restrictions in bozohttpd by using a long path that truncates during checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-5015?

CVE-2014-5015 is a medium-severity authentication bypass vulnerability in Netbsd Netbsd, published on 24 Jul 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

Weakness: CWE-264

Which versions are affected by CVE-2014-5015?

It affects 2 products.

Products include Eterna Bozohttpd, Netbsd Netbsd.

How do I fix CVE-2014-5015?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2014-5015 being exploited?

There is no known exploitation of CVE-2014-5015 in the wild and no public exploit code.

All Netbsd Netbsd vulnerabilities

Sources

Also known as GHSA-wxpg-jc4m-2rq2, UBUNTU-CVE-2014-5015.