CVE-2009-4489: Input Validation
header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4489?
CVE-2009-4489 is classified as a medium severity vulnerability.
How do I fix CVE-2009-4489?
To fix CVE-2009-4489, you should upgrade Cherokee to version 0.99.32 or later.
Who is affected by CVE-2009-4489?
CVE-2009-4489 affects all versions of Cherokee up to and including 0.99.31.
What kind of attack can happen due to CVE-2009-4489?
CVE-2009-4489 can allow remote attackers to execute arbitrary commands or modify window titles through untrusted log data.
What is the nature of the vulnerability in CVE-2009-4489?
CVE-2009-4489 involves improper handling of non-printable characters in HTTP requests, leading to potential log file manipulation.