Executive Summary

Informations
Name MDVSA-2014:036 First vendor Publication 2014-02-17
Vendor Mandriva Last vendor Modification 2014-02-17
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Updated varnish packages fix security vulnerabilities:

Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI (CVE-2013-4484).

Also, the services have been converted from SysV init scripts to systemd-native services, which should allow for more consistent behavior.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2014:036

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20532
 
Oval ID: oval:org.mitre.oval:def:20532
Title: DSA-2814-1 varnish - denial of service
Description: A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.
Family: unix Class: patch
Reference(s): DSA-2814-1
CVE-2013-4484
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): varnish
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 26

Nessus® Vulnerability Scanner

Date Description
2014-12-16 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-30.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-864.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-865.nasl - Type : ACT_GATHER_INFO
2014-05-06 Name : The remote Fedora host is missing a security update.
File : fedora_2013-24018.nasl - Type : ACT_GATHER_INFO
2014-05-06 Name : The remote Fedora host is missing a security update.
File : fedora_2013-24023.nasl - Type : ACT_GATHER_INFO
2014-02-18 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-036.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-276.nasl - Type : ACT_GATHER_INFO
2014-01-27 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_d9dbe6e884da11e398bd080027f2d077.nasl - Type : ACT_GATHER_INFO
2013-12-10 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2814.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-19 13:21:58
  • Multiple Updates
2014-02-17 21:19:31
  • First insertion