Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv2

CVE-2009-4492

Published: 13/01/2010 Updated: 01/08/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 755
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Ruby-lang

Vulnerability Summary

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote malicious users to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Vulnerable Product Search on Vulmon Subscribe to Product

ruby-lang webrick 1.3.1

Vendor Advisories

Ubuntu Security Notice: ruby1.9 vulnerabilities
Emmanouel Kellinis discovered that Ruby did not properly handle certain string operations An attacker could exploit this issue and possibly execute arbitrary code with application privileges (CVE-2009-4124) ...

Exploits

Exploit DB: Ruby 1.9.1 - WEBrick 'Terminal Escape Sequence in Logs' Command Injection
source: wwwsecurityfocuscom/bid/37710/info Ruby WEBrick is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files Attackers can exploit this issue to execute arbitrary commands in a terminal Versions *prior to* the following are affected: Ruby 186 patchlevel 388 Ruby 18 ...
Exploit DB: Nginx, Varnish, Cherokee, etc Log Injection
Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa are subject to log escape sequence injection vulnerabilities ...

References

NVD-CWE-noinfohttp://www.ush.it/team/ush/hack_httpd_escape/adv.txthttp://www.securityfocus.com/bid/37710http://securitytracker.com/id?1023429http://secunia.com/advisories/37949http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injectionhttp://www.vupen.com/english/advisories/2010/0089http://www.redhat.com/support/errata/RHSA-2011-0908.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0909.htmlhttp://www.securityfocus.com/archive/1/508830/100/0/threadedhttps://usn.ubuntu.com/900-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/33489/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
path traversalCVE-2024-26978CVE-2024-26982wirelessCVE-2023-6949CVE-2024-26980CVE-2024-32766CVE-2024-26939cache poisoning
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook