CVE

Id
41923  
CVE No.
CVE-2009-4488  
Status
Candidate  
Description
** DISPUTED ** Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window"s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. NOTE: the vendor disputes the significance of this report, stating that "This is not a security problem in Varnish or any other piece of software which writes a logfile. The real problem is the mistaken belief that you can cat(1) a random logfile to your terminal safely."  
Phase
Assigned (20091230)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
459573 41923 CVE-2009-4488 BUGTRAQ:20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection  View
459574 41923 CVE-2009-4488 URL:http://www.securityfocus.com/archive/1/archive/1/508830/100/0/threaded  View
459575 41923 CVE-2009-4488 MISC:http://www.ush.it/team/ush/hack_httpd_escape/adv.txt  View
459576 41923 CVE-2009-4488 BID:37713  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
37079 JVNDB-2010-002859 Ruby の WEBrick におけるウィンドウのタイトルを変更される脆弱性 Ruby の WEBrick は、非印字可能文字を削除せずにログファイルへの書き込みを行うため、ウィンドウのタイトルを変更される、または任意のコードを実行される、もしくはファイルを上書きされる脆弱性が存在します。 CVE-2009-4492 41923 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002859.html  View