From 78248c90c1f372226f8881bb99c2fb18bf076d5c Mon Sep 17 00:00:00 2001
From: Martin Wilke Florian Weimer of the Red Hat Product Security Team reports: Due to a missing check during assembly of the HTTP request line a long target server name in the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources. Due to a missing check during assembly of the HTTP request line a long
+ target server name in the PROXY-CONNECT address can cause a stack buffer
+ overrun. Exploitation requires that the attacker is able to provide the
+ target server name to the PROXY-CONNECT address in the command line.
+ This can happen for example in scripts that receive data from untrusted
+ sources. The OTRS Project reports: An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks. An attacker that managed to take over the session of a logged in customer
+ could create tickets and/or send follow-ups to existing tickets due to
+ missing challenge token checks.
-
@@ -115,7 +120,9 @@ Note: Please add new entries to the beginning of this file.
-
@@ -269,8 +276,10 @@ Note: Please add new entries to the beginning of this file.
there will be a brief interruption of service and the cache will be
emptied, causing more traffic to go to the backend.
We are releasing this advisory because restarting from vcl_error{} is both fairly common and documented.
-This is purely a denial of service vulnerability, there is no risk of privilege escalation.
+We are releasing this advisory because restarting from vcl_error{} is + both fairly common and documented.
+This is purely a denial of service vulnerability, there is no risk of + privilege escalation.
Workaround
Insert this at the top of your VCL file: