VIR Vulnerability Intelligence Relay

CVE-2014-5015

medium
Published 2014-07-24 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.0

Description

bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27
{Vendor advisory: security@debian.org — ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-007.txt.asc}

OS impact
OSVersionStatusFixed in
freebsd freebsd5.1affected
freebsd freebsd5.2affected
freebsd freebsd6.0affected
freebsd freebsd6.1affected

Application impact
VendorProductVersionsFixed
eternabozohttpd{"endIncluding":"20140201"}
eternabozohttpd19990519
eternabozohttpd20000421
eternabozohttpd20000426
eternabozohttpd20000427
eternabozohttpd20000815
eternabozohttpd20000825
eternabozohttpd20010610
eternabozohttpd20010812
eternabozohttpd20010922
eternabozohttpd20020710
eternabozohttpd20020730
eternabozohttpd20020803
eternabozohttpd20020804
eternabozohttpd20020823
eternabozohttpd20020913
eternabozohttpd20021106
eternabozohttpd20030313
eternabozohttpd20030409
eternabozohttpd20030626
eternabozohttpd20031005
eternabozohttpd20040218
eternabozohttpd20040808
eternabozohttpd20050410
eternabozohttpd20060517
eternabozohttpd20060710
eternabozohttpd20080303
eternabozohttpd20090417
eternabozohttpd20090522
eternabozohttpd20100509
eternabozohttpd20100512
eternabozohttpd20100617
eternabozohttpd20100621
eternabozohttpd20100920
eternabozohttpd20111118
eternabozohttpd20140102

References

CWEs

CWE-264

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.