13

I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd?

Being a lesser known web server means that it's less likely to be targeted by attacks, but maybe also less tested.

Improve this question
1
  • 4
    When the purpose of a piece of software is "experiment" then I really don't think the flag could get any redder. It's great to support software in development because "you never know" but for the time being use at your own risk and do not use at the risk of a production system accessible from the wild.
    – MonkeyZeus
    Sep 29, 2015 at 20:36

3 Answers 3

Reset to default
28

Update: As pointed out by Moti Korets here, my answer relates to "Vector Ultra Mini Httpd", not "ACME mini_httpd" that I now realise was being asked for by the OP.

Vector Ultra Mini Httpd

No it is not secure.

Even the latest version, v1.21 suffers from a serious stack based buffer overflow meaning that a remote attacker can gain control of your system. CVE here.

ACME mini_httpd

See jimis excellent answer here.

Improve this answer
2
  • There must be a confusion here. The link is to a totally different server named similarly "Ultra Mini HTTPD". I suggest you edit your answer.
    – Moti Korets
    May 18, 2017 at 9:35
  • You're right, my answer is based on a different product.
    – SilverlightFox
    May 18, 2017 at 19:54
14

I would not rely on the obscurity of mini_httpd to improve security.

As mentioned in SilverlightFox's answer, there is an outstanding vulnerability. I am surprised that there are not further issues - it could be that people just haven't tested.

To me, as an embedded systems pen-tester, mini_httpd is a red flag. If I see this in the headers, there will nearly always be a vulnerability somewhere else. This is of course anecdotal, but I have seen a very strong correlation.

I would stick with a more well-known and tested daemon.

lighttpd is still relatively lightweight, and they are responsive to security reports. It would be a good choice if you are hoping to host rich, interactive content.

yaSSL by wolfSSL is a security-driven HTTP daemon that is worth looking at. It is very lightweight, and they provide pay-for support if required.

nginx has also become feasible for larger embedded systems in recent years.

Improve this answer
1
  • I would expect the web server in an embedded system to be compromised, as embedded systems tend to never get updated. Therefore I hope the system will be designed assuming that the web server cannot be trusted.
    – Ian Ringrose
    Sep 30, 2015 at 9:41
5

I don't have the privilege to comment on SilverlightFox's answer, so I'll mention here that the linked CVE is about "Ultra mini httpd" which is a Windows HTTP server, possibly different to ACME mini_httpd.

And while mini_httpd seems unmaintained, the Debian developers are doing a good job maintaining it. You might want to check the package page, specifically the debian package source.

In that tarball you'll find the "changelog" file which mentions some bugs and one CVE, so you can apply the patches from the "patches" subdirectory. Or use the maintained Debian package.

I believe you are well covered then, and mini-httpd should be secure enough.

Improve this answer
1
  • +1 I agree with this analysis, and one CVE does not make this web server less secure (others have even more)
    – user45139
    Sep 30, 2015 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.