[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 03 Jul 2014 13:41:58 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Varnish - no CVE == bug regression
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/07/14 11:12 AM, Stefan Bühler wrote:
> On Thu, 3 Jul 2014 08:15:06 +0000 Sven Kieske
> <S.Kieske@...twald.de> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>
>> I'd agree with this. And I don't get the argument from
>> poul-henning kamp, what I understand is: "hey, we trust our
>> backend server" well, but your backend server can make you crash,
>> so you probably shouldn't trust it in the first place?
>>
>> you _never_ can trust input, so you have to validate it, either
>> way, at least enough to not crash or perform malicious actions.
>>
>> Am 03.07.2014 09:48, schrieb Kurt Seifried:
>>> So as I understand this: Varnish front end for web servers, the
>>> web servers can trigger varnish to restart. Are the back end
>>> servers supposed to be able to cause varnish to restart?
>>>
>>> I'm guessing not. Scenario: hosting env, or a website with a
>>> vuln, whatever, you can now cause the varnish front ends to
>>> restart constantly, effectively causing a permanent denial of
>>> service.
>>>
>>> That sounds CVE worthy. Or am I missing something?
>
> you should never trust *untrusted* input. your root shell usually
> trusts the input it gets...
>
> so the valgrind developers decided that they consider the backend
> webservers trusted, at least regarding the capability to cause a
> DoS.
>
> for the record - so does lighttpd (a backend can trigger OOM as
> lighty reads (nearly) as fast as possible from a backend, as
> backends often only handle one request at a time); we usually tell
> people to use X-sendfile instead of sending ISOs through php.
That also sounds like it needs a CVE then. You should not be able to
trivially DoS stuff, especially OOM, things should protect themselves
from OOM'ing especially if they accept user controlled input from the
network.
> just because you disagree with such decisions doesn't make it CVE
> worthy (missing or wrong documentation could).
So to be clear your argument is that the http backends serviced by
Varnish are supposed to be able to shut down Varnish, not by using an
administrative channel/command but by executing a denial of service
against Varnish? And that this is intended behaviour and thus not a
security vulnerability?
> in case you actually want to assign a CVE here, maybe we can get
> one for the bad openssl default cipherstring too? because for that
> it is really obvious that it is f*** wrong, but i think that none
> was assigned because upstream didn't agree with it.
>
> regards, Stefan
>
- --
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJTtbIDAAoJEBYNRVNeJnmT/mkQAMmXrwXn4+Y/hGUGMfp3anFo
7NVLg+50up/BhuVQ5fOA/EYClDQZNWSg8PrQWvo8cxwCtJOsXVFEHmG+2f7xNKkv
rCN97rMVz448hoFSHq5qwtWcZw/V8/A13hlAclDA7f7p+/B57Pok7igOciGwLbJb
zGXeODwFnHlX+eOZgn/hDt0FzG5n1cCHrnK4NgIT/yLSYDI5O235/0g999ooDrn7
FwiOFxdnjkveBkcGde6VJ4TlyqA9qoYJ2S4t/fkvM9j/vXvag+V0wwSdDkpZuFNZ
ycERIVWZW6hnr7aZ/G76Rie2E4LY8B0T9cJF9pTA7FkJWF2Yg8LbPHz5jSH1cQuZ
bOanZXE8bPLAdLHKU0JWbDPYDdhjEk8mgLbbskSmMxslmygw9Z5kceUoug2Y75Xs
LRcpOuv08b3QO3wJNV6Z8fbkOYcdeTJPRmNLYrWoPqJHx8jWZzaUq1d1T8YGqos/
V1KiFzDKH8Yw+yjmYAe+8DXpiOUH90yMYC8d8ewsipDXNNVHhyVUTeV/bNYT+0Gn
MU0GGSd90eLCC+czkw/tgY/XHIE0ycLeWDgTBUYkfOZ4UjgscMF6R5jcuJGMP71L
ftBbGNXduNHLkXL3GFUII+fAWQpWn14usmZZTHsoecmOoBPUV9paRuGBtzPmz+xJ
vHDLLMP7/qSLN88zY2d0
=7hmC
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
