This host is installed with Varnish and is prone to Log Escape Sequence Injection Vulnerability.

Successful exploitation will let the attacker execute arbitrary commands in a terminal. Impact level: Application

Upgrade to Varnish version 2.1.2 or later For updates refer to http://varnish.projects.linpro.no/wiki/WikiStart

The flaw exists when the Web Server is executed in foreground in a pty or when the logfiles are viewed with tools like 'cat' or 'tail' injected control characters reach the terminal and are executed.

Varnish version 2.0.6 and prior.

• http://www.securityfocus.com/archive/1/archive/1/508830/100/0/threaded
• http://www.ush.it/team/ush/hack_httpd_escape/adv.txt

---

Updated on 2015-03-25