Bug 303755 (CVE-2009-4490)

Summary:	www-servers/mini_httpd arbitrary code execution (CVE-2009-4490)
Product:	Gentoo Security	Reporter:	Stefan Behte (RETIRED) <craig>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	www-servers+disabled
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa]
Package list:		Runtime testing required:	---

Description Stefan Behte (RETIRED) gentoo-dev

2010-02-06 15:29:07 UTC

CVE-2009-4490 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4490):
  mini_httpd 1.19 writes data to a log file without sanitizing
  non-printable characters, which might allow remote attackers to
  modify a window's title, or possibly execute arbitrary commands or
  overwrite files, via an HTTP request containing an escape sequence
  for a terminal emulator.

Comment 1 Paweł Hajdan, Jr. (RETIRED) gentoo-dev

2011-02-19 10:23:18 UTC

Still vulnerable. Should we mask it?

Comment 2 Stefan Behte (RETIRED) gentoo-dev

2011-02-22 21:56:35 UTC

Well, this is the same issue as several other in-tree daemons have. e.g. varnish disputed the issue. It's not safe to cat a random file in a term, though one could be of the opinion the daemon should sanitize the logs.

Comment 3 Pacho Ramos gentoo-dev

2012-04-23 18:26:21 UTC

dropped

Comment 4 Tim Sammut (RETIRED) gentoo-dev

2012-05-11 17:26:06 UTC

GLSA request filed.

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2012-06-24 23:11:30 UTC

This issue was resolved and addressed in
 GLSA 201206-27 at http://security.gentoo.org/glsa/glsa-201206-27.xml
by GLSA coordinator Sean Amoss (ackle).