CVE-2009-2936

Name	CVE-2009-2936
Description	The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
varnish (PTS)	jessie, jessie (lts)	4.0.2-1+deb8u1	fixed
	stretch (security), stretch (lts), stretch	5.0.0-7+deb9u3	fixed
	buster	6.1.1-1+deb10u3	fixed
	buster (security)	6.1.1-1+deb10u4	fixed
	bullseye (security), bullseye	6.5.1-1+deb11u3	fixed
	bookworm	7.1.1-1.1	fixed
	sid, trixie	7.1.1-1.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
varnish	source	(unstable)	2.1.0-2	unimportant

Only a security issue if used against best practices