VAR-200801-0319
Vulnerability from variot - Updated: 2025-04-10 23:09Directory traversal vulnerability in the mwGetLocalFileName function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to read arbitrary files and list arbitrary directories via a (1) .%2e (partially encoded dot dot) or (2) %2e%2e (encoded dot dot) in the URI. MiniWeb is prone to a directory-traversal vulnerability and a heap-based buffer-overflow vulnerability. An attacker can exploit this issue to gain access to files outside the webroot, execute arbitrary code within the context of the affected application, or crash the application. This issue affects MiniWeb 0.8.19; other versions may also be affected.
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.
Download and test it today: https://psi.secunia.com/
Read more about this new version: https://psi.secunia.com/?page=changelog
TITLE: MiniWeb HTTP Server Buffer Overflow and Directory Traversal
SECUNIA ADVISORY ID: SA28512
VERIFY ADVISORY: http://secunia.com/advisories/28512/
CRITICAL: Highly critical
IMPACT: Exposure of system information, Exposure of sensitive information, DoS, System access
WHERE:
From remote
SOFTWARE: MiniWeb HTTP Server 0.x http://secunia.com/product/14459/
DESCRIPTION: Hamid Ebadi has discovered two vulnerabilities in MiniWeb HTTP Server, which can be exploited by malicious people to disclose sensitive information, to cause a DoS (Denial of Service), or to potentially compromise a vulnerable system.
1) A boundary error exists within the "_mwProcessReadSocket()" function in http.c. This can be exploited to cause a heap-based buffer overflow via a URL that is 3600-4000 characters long.
Successful exploitation of this vulnerability allows performing a DoS (Denial of Service) or the potential execution of arbitrary code.
2) Input passed in the URL to the "mwGetLocalFileName()" function in http.c is not properly sanitised before being used. This can be exploited to display arbitrary files with directory traversal attacks of the form ".%2e/.%2e/" or "%2e%2e/%2e%2e/".
The vulnerabilities are confirmed in version 0.8.19.
SOLUTION: Restrict access to the web service.
Use another product.
PROVIDED AND/OR DISCOVERED BY: Hamid Ebadi
ORIGINAL ADVISORY: http://www.bugtraq.ir/adv/miniweb_english.pdf
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200801-0319",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "miniweb http server",
"scope": "eq",
"trust": 2.4,
"vendor": "miniweb http server",
"version": "0.8.19"
},
{
"model": "huang miniweb",
"scope": "eq",
"trust": 0.3,
"vendor": "stanley",
"version": "0.8.19"
}
],
"sources": [
{
"db": "BID",
"id": "27319"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:miniweb_http_server:miniweb_http_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hamid Ebadi",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
}
],
"trust": 0.6
},
"cve": "CVE-2008-0338",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2008-0338",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-0338",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2008-0338",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200801-273",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Directory traversal vulnerability in the mwGetLocalFileName function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to read arbitrary files and list arbitrary directories via a (1) .%2e (partially encoded dot dot) or (2) %2e%2e (encoded dot dot) in the URI. MiniWeb is prone to a directory-traversal vulnerability and a heap-based buffer-overflow vulnerability. \nAn attacker can exploit this issue to gain access to files outside the webroot, execute arbitrary code within the context of the affected application, or crash the application. \nThis issue affects MiniWeb 0.8.19; other versions may also be affected. \n\n----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\nMiniWeb HTTP Server Buffer Overflow and Directory Traversal\n\nSECUNIA ADVISORY ID:\nSA28512\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/28512/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nExposure of system information, Exposure of sensitive information,\nDoS, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nMiniWeb HTTP Server 0.x\nhttp://secunia.com/product/14459/\n\nDESCRIPTION:\nHamid Ebadi has discovered two vulnerabilities in MiniWeb HTTP\nServer, which can be exploited by malicious people to disclose\nsensitive information, to cause a DoS (Denial of Service), or to\npotentially compromise a vulnerable system. \n\n1) A boundary error exists within the \"_mwProcessReadSocket()\"\nfunction in http.c. This can be exploited to cause a heap-based\nbuffer overflow via a URL that is 3600-4000 characters long. \n\nSuccessful exploitation of this vulnerability allows performing a DoS\n(Denial of Service) or the potential execution of arbitrary code. \n\n2) Input passed in the URL to the \"mwGetLocalFileName()\" function in\nhttp.c is not properly sanitised before being used. This can be\nexploited to display arbitrary files with directory traversal attacks\nof the form \".%2e/.%2e/\" or \"%2e%2e/%2e%2e/\". \n\nThe vulnerabilities are confirmed in version 0.8.19. \n\nSOLUTION:\nRestrict access to the web service. \n\nUse another product. \n\nPROVIDED AND/OR DISCOVERED BY:\nHamid Ebadi\n\nORIGINAL ADVISORY:\nhttp://www.bugtraq.ir/adv/miniweb_english.pdf\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0338"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "BID",
"id": "27319"
},
{
"db": "PACKETSTORM",
"id": "62677"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-0338",
"trust": 2.7
},
{
"db": "BID",
"id": "27319",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "28512",
"trust": 1.7
},
{
"db": "EXPLOIT-DB",
"id": "4923",
"trust": 1.6
},
{
"db": "VUPEN",
"id": "ADV-2008-0176",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003960",
"trust": 0.8
},
{
"db": "XF",
"id": "39718",
"trust": 0.6
},
{
"db": "MILW0RM",
"id": "4923",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200801-273",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "62677",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "27319"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "PACKETSTORM",
"id": "62677"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"id": "VAR-200801-0319",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.26666668
},
"last_update_date": "2025-04-10T23:09:40.476000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "MiniWeb HTTP server",
"trust": 0.8,
"url": "http://sourceforge.net/projects/miniweb/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.bugtraq.ir/adv/miniweb_english.pdf"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/28512"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/27319"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39713"
},
{
"trust": 1.0,
"url": "http://www.vupen.com/english/advisories/2008/0176"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/4923"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0338"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-0338"
},
{
"trust": 0.6,
"url": "http://www.milw0rm.com/exploits/4923"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/39718"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0176"
},
{
"trust": 0.3,
"url": "http://sourceforge.net/projects/miniweb"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/14459/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/28512/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "BID",
"id": "27319"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "PACKETSTORM",
"id": "62677"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "27319"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"db": "PACKETSTORM",
"id": "62677"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-01-16T00:00:00",
"db": "BID",
"id": "27319"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"date": "2008-01-17T04:45:41",
"db": "PACKETSTORM",
"id": "62677"
},
{
"date": "2008-01-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"date": "2008-01-17T22:00:00",
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-05T22:00:00",
"db": "BID",
"id": "27319"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-003960"
},
{
"date": "2008-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200801-273"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2008-0338"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MiniWeb HTTP Server of http.c Vulnerable to directory traversal",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003960"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-273"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…