Bug 303755 – www-servers/mini_httpd arbitrary code execution (CVE-2009-4490)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Stefan Behte (RETIRED) 2010-02-06 15:29:07 UTC]

CVE-2009-4490 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4490):
  mini_httpd 1.19 writes data to a log file without sanitizing
  non-printable characters, which might allow remote attackers to
  modify a window's title, or possibly execute arbitrary commands or
  overwrite files, via an HTTP request containing an escape sequence
  for a terminal emulator.

[Comment 1 Paweł Hajdan, Jr. (RETIRED) 2011-02-19 10:23:18 UTC]

Still vulnerable. Should we mask it?

[Comment 2 Stefan Behte (RETIRED) 2011-02-22 21:56:35 UTC]

Well, this is the same issue as several other in-tree daemons have. e.g. varnish disputed the issue. It's not safe to cat a random file in a term, though one could be of the opinion the daemon should sanitize the logs.

[Comment 3 Pacho Ramos 2012-04-23 18:26:21 UTC]

dropped

[Comment 4 Tim Sammut (RETIRED) 2012-05-11 17:26:06 UTC]

GLSA request filed.

[Comment 5 GLSAMaker/CVETool Bot 2012-06-24 23:11:30 UTC]

This issue was resolved and addressed in
 GLSA 201206-27 at http://security.gentoo.org/glsa/glsa-201206-27.xml
by GLSA coordinator Sean Amoss (ackle).