CVE-2009-4488

DISPUTED Varnish 2.0.6 writes data to a log file without sanitizing
non-printable characters, which might allow remote attackers to modify a
window’s title, or possibly execute arbitrary commands or overwrite files,
via an HTTP request containing an escape sequence for a terminal emulator.
NOTE: the vendor disputes the significance of this report, stating that
“This is not a security problem in Varnish or any other piece of software
which writes a logfile. The real problem is the mistaken belief that you
can cat(1) a random logfile to your terminal safely.”

Notes