#VU39815 Input validation error in NetBSD - CVE-2015-8212

Vulnerability identifier: #VU39815

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-8212

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
NetBSD
Operating systems & Components / Operating system

Vendor: NetBSD Foundation, Inc

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program.

Mitigation
Install update from vendor's website.

Vulnerable software versions

NetBSD: 6.0 - 7.0

---

External links
https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-005.txt.asc
https://www.securitytracker.com/id/1035673

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.