CVE-2009-4492

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/37949	Not Applicable Vendor Advisory
http://securitytracker.com/id?1023429	Broken Link Exploit Third Party Advisory VDB Entry
http://www.redhat.com/support/errata/RHSA-2011-0908.html	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0909.html	Third Party Advisory
http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection	Patch Vendor Advisory
http://www.securityfocus.com/archive/1/508830/100/0/threaded	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/37710	Broken Link Exploit Third Party Advisory VDB Entry
http://www.ush.it/team/ush/hack_httpd_escape/adv.txt	Broken Link Exploit
http://www.vupen.com/english/advisories/2010/0089	Permissions Required

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ruby-lang:webrick:1.3.1:*:*:*:*:ruby:*:*

OR	cpe:2.3:a:ruby-lang:ruby::::::::
	cpe:2.3:a:ruby-lang:ruby::::::::
	cpe:2.3:a:ruby-lang:ruby::::::::

History

No history.

Information

Published : 2010-01-13 20:30

Updated : 2023-08-01 18:59

NVD link : CVE-2009-4492

Mitre link : CVE-2009-4492

CVE.ORG link : CVE-2009-4492

JSON object : View

Products Affected

ruby-lang

webrick
ruby

CWE

NVD-CWE-noinfo

{"id": "CVE-2009-4492", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-01-13T20:30:00.530", "references": [{"url": "http://secunia.com/advisories/37949", "tags": ["Not Applicable", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1023429", "tags": ["Broken Link", "Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0908.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0909.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/508830/100/0/threaded", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/37710", "tags": ["Broken Link", "Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.ush.it/team/ush/hack_httpd_escape/adv.txt", "tags": ["Broken Link", "Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2010/0089", "tags": ["Permissions Required"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator."}, {"lang": "es", "value": "WEBrick v1.3.1 en Ruby v1.8.6 del patchlevel 383, v1.8.7 al patchlevel 248, v1.8.8dev, 1.9.1 al patchlevel 376, y v1.9.2dev ,escribe datos en un archivo de los sin depurar los caracteres no escribibles, lo que podr\u00eda permitir a atacantes remotos modificar la ventana de t\u00edtulo, o posiblemente ejecutar comandos de su elecci\u00f3n o sobrescribir archivos, a trav\u00e9s de una petici\u00f3n HTTP que contiene una secuencia de escape para el emulador de terminal."}], "lastModified": "2023-08-01T18:59:27.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:webrick:1.3.1:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "A3987438-FB66-4B8A-A2E2-124139BC9216"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9D02C3E0-04FE-4200-944F-2EF327B8CC37", "versionEndIncluding": "1.8.6.383", "versionStartIncluding": "1.8.6"}, {"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0F4C4DE1-EDEF-49F4-81FE-6B9D25453300", "versionEndIncluding": "1.8.7.248", "versionStartIncluding": "1.8.7"}, {"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "20792FA1-E46A-4BC1-81FD-E3C4660F2CC6", "versionEndIncluding": "1.9.1.376", "versionStartIncluding": "1.9.1"}], "operator": "OR"}], "operator": "AND"}], "vendorComments": [{"comment": "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-4492\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.\n", "lastModified": "2010-01-21T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}