Description
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | trafficserver | 3.0.4-1 | — |
References
- 20120322 [ANNOUNCE] Apache Traffic Server releases for security incident CVE-2012-0256 mailing-list
- 20120322 [ANNOUNCE] Apache Traffic Server releases for security incident CVE-2012-0256 mailing-list
- 52696 vdb-entry
- https://www.cert.fi/en/reports/2012/vulnerability612884.html
- 1026847 vdb-entry
- http://trafficserver.apache.org/downloads