Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 303753 (CVE-2009-4489) - www-servers/cherokee arbitrary code execution (CVE-2009-4489)
Summary: www-servers/cherokee arbitrary code execution (CVE-2009-4489)
Status: RESOLVED FIXED
Alias: CVE-2009-4489
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://svn.cherokee-project.com/chang...
Whiteboard: ~2 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2010-02-06 15:27 UTC by Stefan Behte (RETIRED)
Modified: 2010-03-06 17:04 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2010-02-06 15:27:54 UTC 
CVE-2009-4489 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4489):
  header.c in Cherokee before 0.99.32 writes data to a log file without
  sanitizing non-printable characters, which might allow remote
  attackers to modify a window's title, or possibly execute arbitrary
  commands or overwrite files, via an HTTP request containing an escape
  sequence for a terminal emulator.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2010-02-06 15:28:34 UTC 
Please provide a newer ebuild.
Comment 2 José Alberto Suárez López (RETIRED) gentoo-dev 2010-02-08 08:33:28 UTC 
0.99.42 is now in portage
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2010-03-06 17:04:38 UTC 
Closing noglsa.