Venustech Apache VCL up to 2.5 Block Argument input validation

Summaryinfo

A vulnerability was found in Venustech Apache VCL 2.1/2.2/2.3/2.4/2.5. It has been classified as critical. Impacted is an unknown function of the component Block Handler. This manipulation as part of Argument causes input validation. This vulnerability appears as CVE-2018-11773. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Venustech Apache VCL 2.1/2.2/2.3/2.4/2.5. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Block Handler. The manipulation as part of a Argument leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

The weakness was presented 07/29/2019 (Website). The advisory is shared at lists.apache.org. This vulnerability is known as CVE-2018-11773 since 06/05/2018. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.5.1 eliminates this vulnerability.

See VDB-138914 and VDB-138912 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Venustech

Name

• Apache VCL

Version

• 2.1
• 2.2
• 2.3
• 2.4
• 2.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion