oss-security - [CVE-2018-11773] Apache VCL improper form validation in block allocation management

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <19319537.BvfTLQxH9x@treebeard>
Date: Mon, 29 Jul 2019 11:55:32 -0400
From: Josh Thompson <jfthomps@...che.org>
To: oss-security@...ts.openwall.com
Subject: [CVE-2018-11773] Apache VCL improper form validation in block allocation management

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CVE-2018-11773: Apache VCL improper form validation in block allocation 
management

Severity: Medium

Versions Affected: 2.1 through 2.5

Description: Apache VCL versions 2.1 through 2.5 do not properly validate form 
input when processing a submitted block allocation. The form data is then used 
as an argument to the php built in function strtotime. This allows for an 
attack against the underlying implementation of that function. The 
implementation of strtotime at the time the issue was discovered appeared to 
be resistant to a malicious attack. However, all VCL systems running versions 
earlier than 2.5.1 should be upgraded or patched.

Mitigation: Upgrade to 2.5.1 or apply patches from https://vcl.apache.org/
security.html

Credit: This vulnerability was found and reported to the Apache VCL project by 
ADLab of Venustech.

CVE Released: July 29th, 2019
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEI0cOQm0VAdkhDARZSNnzl+fhyFkFAl0/FvQACgkQSNnzl+fh
yFm1sg/7B/d2H93fCdsBl1N5lhob5Phe23rJ0EYs8ELkptr0+lXSIYLCcQ8brhcj
0lM0aCnzobkJiI/t42HnebJ8rcMIo6fzQ1y4kMzKTVNLc8MiEU3kRV+ZpDMBTN1u
iAhBkjNzNoqZqOP5klmmInEhwbFHsYclFY0OCgabriMxY2WNbiuZEm/v7DwjDTEZ
3Z0xjo3TveMKPtdgfz+hiHm2z8gAOyWbyUVvHBL/+9BewNQXgUHuysD2M0roTZpj
46T4LMu8YKGBWIIRlTDQO463zI4H6bSd5xN7mpDCz1u/sqM2f4JdSP554MIQxpOa
orcJLTaI+jYOplGsxfVM/QXb3jLCuJvuu8ZxHhc4R2GMH3qukWEZ6Mt8r9Rr3JUS
R9AD/y0ZnIhsU+nEjzxs4y7H3B6BK9imQxVhctlOsIGj0hlSpb+xngSnTA/5aZ30
Iay5ZFibntAAefByOS451Ex8rZPJNWcCR22uOnV6YILLiQzWX+gumzkzcAD9g3Rn
/STt4o84WSyjMpBvsKC8Fif8FR/DNEZ5spsHujfzgNfPbRjLLXXQDzqC0yVrRbRM
84OPDIPtmj1Q4bpeMmNDhuuejUekuMCDWX1hlDMyaJO/YsiWGE1ITzcNBuWSbTYJ
uT1KYnnno1S+/EMDsxhdYPGJ6leXVz+5nLpXxQSFOfDzf4ruDDI=
=Qhgv
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.