CVE-2012-0256: Buffer Overflow
Published Mar 26, 2012
·Updated
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
Affected Software
20 affected components
Apache Traffic Server=2.0.0
Apache Traffic Server=2.0.0-alpha
Apache Traffic Server=2.0.1
Apache Traffic Server=2.1.0
Apache Traffic Server=2.1.1
Apache Traffic Server=2.1.2
Apache Traffic Server=2.1.3
Apache Traffic Server=2.1.4
Apache Traffic Server=2.1.5
Apache Traffic Server=2.1.6
Apache Traffic Server=2.1.7
Apache Traffic Server=2.1.8
Apache Traffic Server=2.1.9
Apache Traffic Server=3.0.0
Apache Traffic Server=3.0.1
Apache Traffic Server=3.0.2
Apache Traffic Server=3.0.3
Apache Traffic Server=3.1.0
Apache Traffic Server=3.1.1
Apache Traffic Server=3.1.2
Remediation
Patch Available
Event History
Mar 26, 2012
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-0256?
CVE-2012-0256 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2012-0256?
To resolve CVE-2012-0256, upgrade Apache Traffic Server to versions 3.0.4 or 3.1.3 or later.
3
What versions of Apache Traffic Server are affected by CVE-2012-0256?
CVE-2012-0256 affects Apache Traffic Server versions 2.0.x, 2.1.x, and 3.0.x prior to 3.0.4 and 3.1.x prior to 3.1.3.
4
What type of attack does CVE-2012-0256 facilitate?
CVE-2012-0256 allows remote attackers to cause a denial of service by exploiting improper heap memory allocation.
5
Can CVE-2012-0256 be exploited remotely?
Yes, CVE-2012-0256 can be exploited remotely through crafted HTTP Host headers.