CVE

Id
40371  
CVE No.
CVE-2009-2936  
Status
Candidate  
Description
** DISPUTED ** The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim"s location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless."  
Phase
Assigned (20090823)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
443679 40371 CVE-2009-2936 BUGTRAQ:20100329 Medium security hole in Varnish reverse proxy  View
443680 40371 CVE-2009-2936 URL:http://www.securityfocus.com/archive/1/archive/1/510360/100/0/threaded  View
443681 40371 CVE-2009-2936 BUGTRAQ:20100329 Re: [Full-disclosure] Medium security hole in Varnish reverse proxy  View
443682 40371 CVE-2009-2936 URL:http://www.securityfocus.com/archive/1/archive/1/510368/100/0/threaded  View
443683 40371 CVE-2009-2936 MISC:http://www.varnish-cache.org/changeset/3865  View
443684 40371 CVE-2009-2936 MISC:http://www.varnish-cache.org/wiki/CLI  View
443685 40371 CVE-2009-2936 FEDORA:FEDORA-2010-6719  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
45249 JVNDB-2009-006256 Python 用の pygresql モジュールにおけるマルチバイト文字のエンコーディングに関する問題を利用される脆弱性 Python 用の pygresql モジュールは、PQescapeStringConn 関数を適切にサポートしないため、マルチバイト文字のエンコーディングに関する問題を利用される脆弱性が存在します。 CVE-2009-2940 40371 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-006256.html  View