Description
HTTP File Server (HFS) before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication.
References
- hfs-unspecified-log-injection(39876) vdb-entry
- 20080123 Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability mailing-list
- http://www.rejetto.com/hfs/?f=wn
- 27423 vdb-entry
- http://www.syhunt.com/advisories/hfs-1-username.txt
- http://www.syhunt.com/advisories/hfshack.txt
- 28631 third-party-advisory
- 3582 third-party-advisory