News
Vigil@nce - Varnish: buffer overflow of Content-Length
March 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker, who is located behind Varnish, can generate a buffer
overflow via a Content-Length on Varnish, in order to trigger a
denial of service, and possibly to execute code.
Impacted products: Varnish
Severity: 2/4
Creation date: 09/03/2015
DESCRIPTION OF THE VULNERABILITY
The Varnish product is positioned as a cache in front of a web
server.
The HTTP Content-Length header indicates the size of the body data.
However, if this header is malformed, and if the size of data is
greater than the size of the storage array, an overflow occurs.
An attacker, who is located behind Varnish, can therefore generate
a buffer overflow via a Content-Length on Varnish, in order to
trigger a denial of service, and possibly to execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Varnish-buffer-overflow-of-Content-Length-16340
