thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program
The redirect CGI program shipped with thttpd v2.26 has a stack buffer overflow that unauthenticated attackers can trigger for crashes or possible code execution.
A stack-based buffer overflow exists in the redirect CGI program distributed with thttpd v2.26. Unsafe string concatenation when constructing redirect URLs from attacker-controlled CGI environment variables causes the overflow. A remote, unauthenticated attacker can trigger it via a crafted HTTP request, crashing the CGI process and causing denial of service. In environments lacking modern exploit mitigations, code execution may also be possible.
25