CVE

Id
41927  
CVE No.
CVE-2009-4492  
Status
Candidate  
Description
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window"s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.  
Phase
Assigned (20091230)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
459591 41927 CVE-2009-4492 BUGTRAQ:20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection  View
459592 41927 CVE-2009-4492 URL:http://www.securityfocus.com/archive/1/archive/1/508830/100/0/threaded  View
459593 41927 CVE-2009-4492 MISC:http://www.ush.it/team/ush/hack_httpd_escape/adv.txt  View
459594 41927 CVE-2009-4492 CONFIRM:http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection  View
459595 41927 CVE-2009-4492 REDHAT:RHSA-2011:0908  View
459596 41927 CVE-2009-4492 URL:http://www.redhat.com/support/errata/RHSA-2011-0908.html  View
459597 41927 CVE-2009-4492 REDHAT:RHSA-2011:0909  View
459598 41927 CVE-2009-4492 URL:http://www.redhat.com/support/errata/RHSA-2011-0909.html  View
459599 41927 CVE-2009-4492 BID:37710  View
459600 41927 CVE-2009-4492 URL:http://www.securityfocus.com/bid/37710  View
459601 41927 CVE-2009-4492 SECTRACK:1023429  View
459602 41927 CVE-2009-4492 URL:http://securitytracker.com/id?1023429  View
459603 41927 CVE-2009-4492 SECUNIA:37949  View
459604 41927 CVE-2009-4492 URL:http://secunia.com/advisories/37949  View
459605 41927 CVE-2009-4492 VUPEN:ADV-2010-0089  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
37846 JVNDB-2010-003631 Boa におけるウィンドウのタイトルを変更される脆弱性 Boa は、印刷不可能な文字列をサニタイズせずにログファイルにデータを書き込むため、ウィンドウのタイトルを変更される、または任意のコマンドを実行される、またはファイルを上書きされる脆弱性が存在します。 CVE-2009-4496 41927 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003631.html  View