Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Apache Traffic Server 5.3.x < 5.3.1 'url_sig' Plugin Multiple Vulnerabilities

High

Synopsis

The remote caching server is affected by multiple vulnerabilities.

Description

Apache Traffic Server, an open source caching server, is installed on the remote host.

Apache Traffic Server versions 5.3.x prior to 5.3.1 are affected by the following vulnerabilities in the 'url_sig' plugin :

- An out-of-bounds access error exists that is triggered when handling a specially crafted HTTP request. An unauthenticated, remote attacker can exploit this to crash the server. (OSVDB 128881) - A security bypass vulnerability exists due to a flaw that is triggered when handling empty secret key URLs. An unauthenticated, remote attacker can exploit this to bypass validation mechanisms, thereby gaining access to protected assets. (OSVDB 128882)

Solution

Upgrade to Apache Traffic Server 5.3.1, or later. Alternatively, disable the 'url_sig' plugin.