Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

https://cwiki.apache.org/confluence/display/TS/What%27s+New+in+v5.3.x

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apache Traffic Server versions prior to 4.2.1.1 / 5.0.1 are affected by an unspecified flaw in traffic_cop that is triggered as the program fails to restrict access to synthetic health checks, which may allow an attacker to cause a denial of service.

According to its banner, the version of Apache Traffic Server running on the remote host is prior to 4.2.1.1 / 5.0.1. It is, therefore, affected by an unspecified vulnerability related to synthetic health checks.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Bryan Call reports :

Below is our announcement for the security issue reported to us from Yahoo! Japan. All versions of Apache Traffic Server are vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1 immediately.

This fixes CVE-2014-3525 and limits access to how the health checks are performed.

Fix CVE-2014-3525.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84517	Fedora 22 : trafficserver-5.3.0-1.fc22 (2015-10524)	Nessus	Fedora Local Security Checks	critical
84516	Fedora 21 : trafficserver-5.3.0-1.fc21 (2015-10520)	Nessus	Fedora Local Security Checks	critical
8621	Apache Traffic Server < 4.2.1.1 / 5.0.1 DoS	Nessus Network Monitor	Web Servers	high
80917	Apache Traffic Server 4.x < 4.2.1.1 / 5.x < 5.0.1 Synthetic Health Check Vulnerability	Nessus	Web Servers	critical
77560	FreeBSD : trafficserver -- unspecified vulnerability (6318b303-3507-11e4-b76c-0011d823eebd)	Nessus	FreeBSD Local Security Checks	critical
77094	Fedora 20 : trafficserver-4.2.1.1-0.fc20 (2014-8790)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2014-3525

critical

Tenable Plugins

critical

critical

high

critical

critical

critical