Description

header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Remediation

References

CVE-2009-4489

Related Vulnerabilities

MySQL CVE-2013-3839 Vulnerability (CVE-2013-3839)

WordPress Plugin Quick Page/Post Redirect Open Redirect (5.1.5)

TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-3942)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-4214)

Internet Information Services Uncontrolled Resource Consumption Vulnerability (CVE-2009-2521)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2009-4489