Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-2271: MiniShare can run attacker code via long web request

CVE-2004-2271 · published 21 years ago

Summary

Versions of MiniShare up to 1.4.1 let a remote user send an overly long HTTP request that can cause the server to execute any code they choose. This could let an attacker take control of the server or steal data. Update MiniShare to a newer version or apply the vendor's patch, and limit access to the service from untrusted networks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
minishare	minimal_http_server	<= 1.4.1 `cpe:2.3:a:minishare:minimal_http_server::::::::`

Original advisory text

Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0208.html Vendor Advisory
http://secunia.com/advisories/13114 Patch Vendor Advisory
http://securitytracker.com/id?1012106 Exploit
http://sourceforge.net/project/shownotes.php?release_id=241158 Patch
http://www.osvdb.org/11530 Patch
http://www.securiteam.com/exploits/6X00B1PBPC.html Exploit
http://www.securityfocus.com/bid/11620 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17978

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

72% chance of attack within 30 days

Timeline

Published31 Dec 2004

Updated28 Oct 2026

First seen29 Sep 2026

Sources

CVE-2004-2271 · NVD

Track software like this

Free during beta