PT-2018-11659 · Apache · Apache Traffic Server

Publicado 2018-08-29 · Atualizado 2018-11-07 · CVE-2018-1318

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server (ATS) versions 6.0.0 through 6.2.2 Apache Traffic Server (ATS) versions 7.0.0 through 7.1.3

Description The issue arises when method ACLs are added in remap.config, potentially causing a segfault upon a carefully crafted request.

Recommendations For versions 6.0.0 through 6.2.2, upgrade to version 6.2.3 or later. For versions 7.0.0 through 7.1.3, upgrade to version 7.1.4 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1318

DSA-4282-1

Produtos afetados

Apache Traffic Server

Referências · 21

• https://github.com/apache/trafficserver/pull/3195 · Nota
• https://cve.org/CVERecord?id=CVE-2018-1318 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-4282-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1318 · Aviso do Fabricante
• https://lists.apache.org/thread.html/9357cdfb6352f72944411608b712e37196ad9e4bc0f17c4828a26fb2%40%3Cusers.trafficserver.apache.org%3E · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-1318 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1318 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-1318 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1318 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2018/08/29/3 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1318 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8005 · Nota de Segurança
• https://packages.debian.org/src:trafficserver · Nota
• http://securityfocus.com/bid/105176 · Nota
• https://osv.dev/vulnerability/DSA-4282-1 · Aviso do Fabricante