Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.

The remote host is affected by the vulnerability described in GLSA-201607-10 (Varnish: Multiple vulnerabilities)

    Varnish fails to properly validate input from HTTP headers, and does not       deny requests with multiple Content-Length headers.
  Impact :

    Remote attackers could conduct an HTTP response splitting attack, which       may further enable them to conduct Cross-Site Scripting (XSS), Cache       Poisoning, Defacement, and Page Hijacking.
  Workaround :

    There is no known workaround at this time.

Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request. (CVE-2015-8852)

This varnish update to version 3.0.7 fixes the following issues :

Security issues fixed :

  - CVE-2015-8852: Vulnerable to HTTP Smuggling issues:
    Double Content Length and bad EOL. (boo#976097)

Bugs fixed :

  - Stop recognizing a single CR (\r) as a HTTP line     separator.

  - Improved error detection on master-child process     communication, leading to faster recovery (child     restart) if communication loses sync.

  - Fix a corner-case where Content-Length was wrong for     HTTP 1.0 clients, when using gzip and streaming.

  - More robust handling of hop-by-hop headers.

  - Avoid memory leak when adding bans.

Regis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies.

ID	Name	Product	Family	Severity
92480	GLSA-201607-10 : Varnish: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
92223	Amazon Linux AMI : varnish (ALAS-2016-721)	Nessus	Amazon Linux Local Security Checks	high
91205	openSUSE Security Update : varnish (openSUSE-2016-588)	Nessus	SuSE Local Security Checks	high
90686	Debian DSA-3553-1 : varnish - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8852

high

Tenable Plugins

high

high

high

high