Apache Traffic Server 2.0.0 issue

2010.09.15

Credit: Tim Brown

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2010-2952

CWE: CWE-20

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

I was recently taking a look at the Apache Traffic Server project (which I 
believe was formerly developed by Yahoo Inc) and notice a series of potential 
problems relating to the way that it handles DNS.  This proxy does not rely on 
the OS supplied resolver library for resolving hostnames but instead 
implements its own asynchronous resolver.

Whilst reviewing the code, I spotted 3 potential issues which I believe might 
significantly increase the chances of Traffic Server's internal DNS cache being 
poisoned.

The Apache Software Foundation have assigned CVE-2010-2952 to these issues.

Tim
-- 

References:

https://issues.apache.org/jira/browse/TS-425

http://xforce.iss.net/xforce/xfdb/61721

http://www.securityfocus.com/bid/43111

http://www.securityfocus.com/archive/1/archive/1/513598/100/0/threaded

http://www.nth-dimension.org.uk/pub/NDSA20100830.txt.asc

http://trafficserver.apache.org/

http://securitytracker.com/id?1024417

http://secunia.com/advisories/41356

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Apache Traffic Server 2.0.0 issue

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.