vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before
    5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage
    buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
    (CVE-2017-8807)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4824-1 advisory.

    It was discovered that Varnish incorrectly handled certain inputs. A remote attacker could possibly use     this issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-8807: This fixes a possible data leak in stevedore transient objects in varnishd.

Upstream reports: 'It is not inconceiveable that an attack can provoke this situation on vulnerable varnishd instances, where the leaked memory contains confidential data and therefore we have classified this as a security vulnerability.'

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Varnish reports :

A wrong if statement in the varnishd source code means that synthetic objects in stevedores which over-allocate, may leak up to page size of data from a malloc(3) memory allocation.

'shamger' and Carlo Cannas discovered that a programming error in Varnish, a state of the art, high-performance web accelerator, may result in disclosure of memory contents or denial of service.

See https://varnish-cache.org/security/VSV00002.html for details.

ID	Name	Product	Family	Severity
424586	Alpine: multiple varnish packages: security update to 5.2.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424586	Alpine: multiple varnish packages: security update to 5.2.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
407452	Alpine: varnish: security update to 4.1.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407452	Alpine: varnish: security update to 4.1.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
183584	Ubuntu 16.04 ESM : Varnish vulnerability (USN-4824-1)	Nessus	Ubuntu Local Security Checks	critical
400792	Alpine: multiple varnish packages: security update to 5.2.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400792	Alpine: multiple varnish packages: security update to 5.2.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
105902	Fedora 27 : varnish (2017-72b50be8d4)	Nessus	Fedora Local Security Checks	critical
104982	FreeBSD : varnish -- information disclosure vulnerability (17133e7e-d764-11e7-b5af-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
104795	Fedora 25 : varnish (2017-8575fbfe90)	Nessus	Fedora Local Security Checks	critical
104794	Fedora 26 : varnish (2017-5525b6cb5a)	Nessus	Fedora Local Security Checks	critical
104586	Debian DSA-4034-1 : varnish - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-8807

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical