CVE-2017-12425 Integer overflow in n/a
An integer overflow in Varnish HTTP Cache allows attackers to crash the worker process via invalid requests, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12425?
CVE-2017-12425 is a high-severity vulnerability in n/a, published on 4 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.
Weakness: CWE-190
Which versions are affected by CVE-2017-12425?
It affects 3 products.
Products include Varnish-Cache Varnish, Varnish-Software Varnish Cache, Varnish Cache Project Varnish Cache.
How do I fix CVE-2017-12425?
Upgrade to a fixed version.
Is CVE-2017-12425 being exploited?
There is no known exploitation of CVE-2017-12425 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2017-12425, CVE-2017-1000123, DEBIAN-CVE-2017-12425, DSA-3924-1, GHSA-jhqh-84v8-3cw2, MGASA-2017-0253 and 1 more.