Published: 13/12/2013 Updated: 21/02/2014

CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9

VMScore: 454

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd prior to 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote malicious users to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu libmicrohttpd 0.9.29
gnu libmicrohttpd 0.9.28
gnu libmicrohttpd 0.9.21
gnu libmicrohttpd 0.9.20
gnu libmicrohttpd
gnu libmicrohttpd 0.9.30
gnu libmicrohttpd 0.9.23
gnu libmicrohttpd 0.9.22
gnu libmicrohttpd 0.9.25
gnu libmicrohttpd 0.9.24
gnu libmicrohttpd 0.9.17
gnu libmicrohttpd 0.9.16
gnu libmicrohttpd 0.9.27
gnu libmicrohttpd 0.9.26
gnu libmicrohttpd 0.9.19
gnu libmicrohttpd 0.9.18

Debian Bug report logs - #731933 libmicrohttpd: CVE-2013-7038 CVE-2013-7039 Package: libmicrohttpd; Maintainer for libmicrohttpd is Bertrand Marc <bmarc@debianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Wed, 11 Dec 2013 11:54:02 UTC Severity: grave Tags: security Fixed in versions libmicrohttpd/09 ...

Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0932, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header The MHD_http_unescape function in libmicrohttpd ...

Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0932, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header ...

CWE-119 https://bugzilla.redhat.com/show_bug.cgi?id=1039390 http://secunia.com/advisories/55903 http://www.securityfocus.com/bid/64138 https://bugs.gentoo.org/show_bug.cgi?id=493450 https://gnunet.org/svn/libmicrohttpd/ChangeLog http://www.openwall.com/lists/oss-security/2013/12/09/11 http://security.gentoo.org/glsa/glsa-201402-01.xml https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731933 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-7039 https://alas.aws.amazon.com/ALAS-2014-353.html

CVE-2013-7039

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect