CVE-2021-35474
📋 TL;DR
A stack-based buffer overflow vulnerability in Apache Traffic Server's cachekey plugin allows remote attackers to execute arbitrary code or cause denial of service. This affects Apache Traffic Server versions 7.0.0-7.1.12, 8.0.0-8.1.1, and 9.0.0-9.0.1. Organizations using these versions as reverse proxies or content delivery servers are at risk.
💻 Affected Systems
- Apache Traffic Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or deployment of ransomware.
Likely Case
Denial of service causing service disruption and potential data corruption.
If Mitigated
Limited impact if proper network segmentation and least privilege controls are implemented.
🎯 Exploit Status
Buffer overflow vulnerabilities in network services often have low exploitation complexity once details are known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.13, 8.1.2, 9.0.2
Vendor Advisory: https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277@<users.trafficserver.apache.org>
Restart Required: Yes
Instructions:
1. Download patched version from Apache Traffic Server website. 2. Backup configuration files. 3. Stop Traffic Server service. 4. Install patched version. 5. Restore configuration. 6. Start Traffic Server service.
🔧 Temporary Workarounds
Disable cachekey plugin
linuxTemporarily disable the vulnerable cachekey plugin to prevent exploitation.
Edit records.config: CONFIG proxy.config.cachekey.soap_enabled INT 0
Restart Traffic Server: traffic_server -k restart
🧯 If You Can't Patch
- Implement strict network access controls to limit traffic to Traffic Server instances.
- Deploy web application firewall (WAF) rules to detect and block buffer overflow attempts.
🔍 How to Verify
Check if Vulnerable:
Check Traffic Server version: traffic_server -v | grep 'Apache Traffic Server'Check Version:
traffic_server -v | grep 'Apache Traffic Server'Verify Fix Applied:
Verify version is 7.1.13+, 8.1.2+, or 9.0.2+ and test cachekey functionality.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Traffic Server logs
- Unusual process crashes
- Abnormal memory usage patterns
Network Indicators:
- Unusual traffic patterns to cachekey endpoints
- Malformed HTTP requests targeting cache functionality
SIEM Query:
source="traffic_server.log" AND ("segmentation fault" OR "SIGSEGV" OR "buffer overflow")🔗 References
- https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E
- https://www.debian.org/security/2021/dsa-4957
- https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E
- https://www.debian.org/security/2021/dsa-4957
