Insecure File Permissions in Varnish Cache by Varnish Software
CVE-2013-0345

Currently unrated

Key Information:

Vendor: Varnish Cache Project
Status: Varnish Cache
Vendor: CVE Published:; 8 May 2014

🔔 Create Varnish Cache Project Vulnerability Alert

What is CVE-2013-0345?

The affected version of Varnish Cache mistakenly uses world-readable permissions for its log directory (/var/log/varnish/) and its log files. This configuration flaw allows local users with access to the system to read these log files, leading to potential exposure of sensitive information stored within. Organizations running Varnish Cache should review their file permissions to ensure sensitive data is adequately protected, implementing stricter access controls to mitigate the risk of unauthorized information disclosure.

References

http://www.osvdb.org/90586

vdb-entryx_refsource_OSVDB

http://www.openwall.com/lists/oss-security/2013/02/23/4

mailing-listx_refsource_MLIST

http://www.openwall.com/lists/oss-security/2013/02/22/14

mailing-listx_refsource_MLIST

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 8, 2014
Vulnerability Reserved
Dec 6, 2012

CVE-2013-0345 Data

JSON