Description
Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.
Affected products
- cherokee / cherokee_httpd0.1 – 0.1
- cherokee / cherokee_httpd0.1.5 – 0.1.5
- cherokee / cherokee_httpd0.1.6 – 0.1.6
- cherokee / cherokee_httpd0.2 – 0.2
- cherokee / cherokee_httpd0.2.5 – 0.2.5
- cherokee / cherokee_httpd0.2.6 – 0.2.6
- cherokee / cherokee_httpd0.2.7 – 0.2.7
- cherokee / cherokee_httpd0.4.6 – 0.4.6
- cherokee / cherokee_httpd0.4.7 – 0.4.7
- cherokee / cherokee_httpd0.4.8 – 0.4.8
- cherokee / cherokee_httpd0.4.17 – 0.4.17