A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.

For the oldstable distribution (squeeze), this problem has been fixed in version 2.1.3-8+deb6u1. For the stable distribution (wheezy), this problem has been fixed in version 3.0.2-2+deb7u1. For the unstable distribution (sid), this problem has been fixed in version 3.0.5-1. We recommend that you upgrade your varnish packages.

Varnish is a state-of-the-art, high-performance HTTP accelerator. It uses the advanced features in Linux 2.6, FreeBSD 6/7 and Solaris 10 to achieve its high performance.

varnish on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2013/dsa-2814.html

---

Updated on 2015-03-25