CVE-2009-4495: Input Validation
Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4495?
CVE-2009-4495 has a high severity rating due to its potential to allow remote attackers to execute arbitrary commands.
How does CVE-2009-4495 affect Yaws 1.85?
CVE-2009-4495 affects Yaws 1.85 by allowing it to log non-printable characters without sanitization, leading to possible command execution.
How can I fix CVE-2009-4495?
To fix CVE-2009-4495, update Yaws to a version that properly sanitizes log entries to prevent special character exploitation.
Can CVE-2009-4495 be exploited over the network?
Yes, CVE-2009-4495 can be exploited over the network through specially crafted HTTP requests.
What potential impacts can result from exploiting CVE-2009-4495?
Exploiting CVE-2009-4495 can lead to unauthorized command execution and the alteration of window titles.