Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal. This issue affects thttpd 2.25b and mini_httpd 1.19 other versions may also be affected.

• http://www.acme.com/software/mini_httpd/
• http://www.acme.com/software/thttpd/
• http://www.securityfocus.com/archive/1/508830
• http://www.securityfocus.com/bid/37714

---

Updated on 2015-03-25