Test Kennung:	1.3.6.1.4.1.25623.1.0.120568
Kategorie:	Amazon Linux Local Security Checks
Titel:	Amazon Linux: Security Advisory (ALAS-2014-276)
Zusammenfassung:	The remote host is missing an update for the 'varnish' package(s) announced via the ALAS-2014-276 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'varnish' package(s) announced via the ALAS-2014-276 advisory. Vulnerability Insight: Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI. varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information. Affected Software/OS: 'varnish' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0345 58125 http://www.securityfocus.com/bid/58125 90586 http://www.osvdb.org/90586 [oss-security] 20130222 CVE request: varnish world-readable logdir http://www.openwall.com/lists/oss-security/2013/02/22/14 [oss-security] 20130222 Re: CVE request: varnish world-readable logdir http://www.openwall.com/lists/oss-security/2013/02/23/4 Common Vulnerability Exposure (CVE) ID: CVE-2013-4484 20131030 [CVE-2013-4484] DoS vulnerability in Varnish HTTP cache http://archives.neohapsis.com/archives/bugtraq/2013-10/0158.html 55452 http://secunia.com/advisories/55452 55746 http://secunia.com/advisories/55746 DSA-2814 http://www.debian.org/security/2012/dsa-2814 [oss-security] 20131030 Re: CVE number needed for Varnish DoS, also heads-up http://www.openwall.com/lists/oss-security/2013/10/30/5 https://www.varnish-cache.org/trac/ticket/1367 openSUSE-SU-2013:1679 http://lists.opensuse.org/opensuse-updates/2013-11/msg00029.html openSUSE-SU-2013:1683 http://lists.opensuse.org/opensuse-updates/2013-11/msg00033.html
Copyright	Copyright (C) 2015 Greenbone AG

Dies ist nur einer von 146377 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.