Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cherokee_httpd | Cherokee | 0.1 (including) | 0.1 (including) |
| Cherokee_httpd | Cherokee | 0.1.5 (including) | 0.1.5 (including) |
| Cherokee_httpd | Cherokee | 0.1.6 (including) | 0.1.6 (including) |
| Cherokee_httpd | Cherokee | 0.2 (including) | 0.2 (including) |
| Cherokee_httpd | Cherokee | 0.2.5 (including) | 0.2.5 (including) |
| Cherokee_httpd | Cherokee | 0.2.6 (including) | 0.2.6 (including) |
| Cherokee_httpd | Cherokee | 0.2.7 (including) | 0.2.7 (including) |
| Cherokee_httpd | Cherokee | 0.4.6 (including) | 0.4.6 (including) |
| Cherokee_httpd | Cherokee | 0.4.7 (including) | 0.4.7 (including) |
| Cherokee_httpd | Cherokee | 0.4.8 (including) | 0.4.8 (including) |
| Cherokee_httpd | Cherokee | 0.4.17 (including) | 0.4.17 (including) |