Published: 13/01/2010 Updated: 10/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote malicious users to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Vulnerable Product	Search on Vulmon	Subscribe to Product
boa boa 0.94.14rc21

source: wwwsecurityfocuscom/bid/37718/info Boa Webserver is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles Attackers can exploit this issue to execute arbitrary commands in a terminal Boa Webserver 09414rc21 is vulnerable; other versions may also be affected curl ...

Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa are subject to log escape sequence injection vulnerabilities ...

Boa 09413 Boa is a simple and lightweight HTTP server which is occasionally still found in embedded firmware images for serving CGI scripts, files, and more 09413 is the last stable version, and was released in 2002 Known Vulnerabilities Unfixed CVE-2009-4496 - Discovered by the ushit team: Boa's error logs in 09413 (and likely earlier) through 09414-rc21 do

CWE-20 http://www.ush.it/team/ush/hack_httpd_escape/adv.txt http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041271.html http://www.securityfocus.com/bid/37718 http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041274.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041285.html http://secunia.com/advisories/39775 http://www.vupen.com/english/advisories/2010/1133 http://www.securityfocus.com/archive/1/508830/100/0/threaded https://nvd.nist.gov https://github.com/Findorgri/boa-0.94.13 https://www.exploit-db.com/exploits/33504/

CVE-2009-4496

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect