Nostromo web servers exposed by resurrected RCE vulnerability

guest · Oct 23, 2019

Nostromo web servers exposed by resurrected RCE vulnerability
Long-since patched security bug comes back to haunt devs
October 21, 2019
https://portswigger.net/daily-swig/nostromo-web-servers-exposed-by-resurrected-rce-vulnerability

A security researcher has disclosed the existence of a remote code execution (RCE) vulnerability in the open source Nostromo web server software.
On Monday, a threat analyst and bounty hunter with the online handle Sudoka published a technical analysis of the bug, tracked as CVE-2019-16278.

The vulnerability impacts Nostromo, also known as nhttpd, a niche web server used by some in the Unix and open source community but altogether dwarfed in popularity by Apache.
In a blog post, Sudoka said the vulnerability stems from shortcomings in how the path of URLs are verified. Inadequate URL checks mean that an unauthenticated attackers is able to force a server to point to a shell file, resulting in the potential execution of arbitrary code.

According to Sudoka, the latest vulnerability impacts all Nostromo versions, including the latest 1.9.6 release – as well as the developer’s website.
Click to expand...

Marcus Glocker, one of the developers of Nostromo, confirmed that software patches to address the vulnerability were already available.

“Yes, there is a patch available for CVE-2019-16278 and also for CVE-2019-16279,” Glocker told The Daily Swig. “I was waiting for feedback from the CVE creator, but I’ll commit it today night with a change log update on my homepage.”
Click to expand...

Log in or Sign up

Nostromo web servers exposed by resurrected RCE vulnerability

guest Guest

Log in or Sign up

Nostromo web servers exposed by resurrected RCE vulnerability

guest Guest

Useful Searches