[ GLSA 201607-10 ] Varnish

[GLSA]

Gentoo Linux Security Advisory

Title: Varnish: Multiple vulnerabilities (GLSA 201607-10)
Severity: normal
Exploitable: remote
Date: July 20, 2016
Bug(s): #542886
ID: 201607-10

Synopsis

Improper input validation in Varnish allows remote attackers to
conduct HTTP smuggling attacks, and possibly trigger a buffer overflow.


Background

Varnish is a web application accelerator.

Affected Packages

Package: www-servers/varnish
Vulnerable: < 3.0.7
Unaffected: >= 3.0.7
Architectures: All supported architectures


Description

Varnish fails to properly validate input from HTTP headers, and does not
deny requests with multiple Content-Length headers.


Impact

Remote attackers could conduct an HTTP response splitting attack, which
may further enable them to conduct Cross-Site Scripting (XSS), Cache
Poisoning, Defacement, and Page Hijacking.


Workaround

There is no known workaround at this time.

Resolution

All Varnish users should upgrade to the latest version: