-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I sent this out on Monday to both the dev and user lists (and others), but it seems the message never made it to the user list. So, I'm forwarding it now.
Josh - ---------- Forwarded Message ---------- Subject: Apache VCL improper input validation Date: Monday, May 06, 2013, 12:32:14 PM From: Josh Thompson <[email protected]> CVE-2013-0267: Apache VCL improper input validation Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache VCL 2.1, 2.2, 2.2.1, 2.3, 2.3.1 Description: Some parts of VCL did not properly validate input data. This problem was present both in the Privileges portion of the web GUI and in the XMLRPC API. A malicious user having a minimal level of administrative rights could manipulate the data submitted by the web GUI or submit non-standard data to the API to gain additional administrative rights. The API functions that are vulnerable were introduced in 2.3.1. Some of those API functions can also be exploited to perform a DOS attack on the site to remove access from other users and to perform an XSS attack to gain elevated privileges. The vulnerabilities were found by an Apache VCL developer doing a code review. No know exploits are in the wild at this point. Fixed Versions: Apache VCL 2.2.2, 2.3.2 Mitigation: Apache VCL 2.3 and 2.3.1 users should upgrade to 2.3.2 as soon as possible. Apache VCL 2.2 and 2.2.1 users should upgrade to 2.2.2 as soon as possible. Apache VCL 2.1 users should upgrade to 2.2.2 or 2.3.2 as soon as possible. Apache VCL 2.2.2 and 2.3.2 can be downloaded from http://vcl.apache.org/downloads/download.cgi Workarounds: There are no complete workarounds. However, users must have at least nodeAdmin, manageGroup, resourceGrant, or userGrant to exploit the vulnerabilities. Removing that access from anyone that is not fully trusted will minimized chances of an exploit against your site. Josh Thompson Apache VCL release manager - ----------------------------------------- - -- - ------------------------------- Josh Thompson VCL Developer North Carolina State University my GPG/PGP key can be found at pgp.mit.edu All electronic mail messages in connection with State business which are sent to or received by this account are subject to the NC Public Records Law and may be disclosed to third parties. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlGKnvcACgkQV/LQcNdtPQMhDgCfWo9AHLXD9PQGBifEzFn3YqKc jEMAnA+WgiQOjztlVrUdrWnyAprF451h =ngkY -----END PGP SIGNATURE-----
