« Volver al listado

CVE-2017-7670

Estado: ModificadaAlta (7.5)—

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Traffic Control

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7670",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Traffic Control",
          "versions": [
            {
              "status": "affected",
              "version": "1.8.0 incubating"
            },
            {
              "status": "affected",
              "version": "2.0.0 RC0 incubating"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-10T18:29:00.253",
  "references": [
    {
      "url": "https://lists.apache.org/thread.html/42b207e9f526353b504591684bd02a5e9fcb4b8f28534253d07740a0%40%3Cusers.trafficcontrol.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/bb09fc29e9c2ee85b118a3d5748a8a523d30cf691ff8b606c6a1748c%40%3Ccommits.trafficcontrol.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/42b207e9f526353b504591684bd02a5e9fcb4b8f28534253d07740a0%40%3Cusers.trafficcontrol.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/bb09fc29e9c2ee85b118a3d5748a8a523d30cf691ff8b606c6a1748c%40%3Ccommits.trafficcontrol.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol."
    },
    {
      "lang": "es",
      "value": "El componente Traffic Router del proyecto Apache Traffic Control en incubación es vulnerable a un ataque de denegación de servicio de estilo Slowloris. Las conexiones TCP realizadas en el puerto DNS configurado permanecerán en el estado ESTABLISHED hasta que el cliente cierre explícitamente la conexión o se reinicie Traffic Router. Si las conexiones permanecen en el estado ESTABLISHED indefinidamente y se acumulan en número para que coincida con el tamaño del grupo hilo (subprocesos) dedicado al procesamiento de peticiones DNS, el grupo hilo (subprocesos) se agota. Una vez que se agota el grupo de hilo (subprocesos), Traffic Router no puede atender ninguna petición DNS, independientemente del protocolo de transporte."
    }
  ],
  "lastModified": "2026-06-17T01:24:56.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DBD0BDC-FE45-4783-836C-98AC3C1AD582",
              "versionEndIncluding": "1.8.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:1.8.1:rc0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C7D341B-4BCD-4040-9539-0B3D3BF489AA"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:2.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4A5940F-5AF1-4E6A-8D40-800C402188DE"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:2.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A07F5552-C1D7-4D61-A7EA-FACE14BFB707"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:2.0.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF329CC2-2B4C-46B7-AAB3-5902C66731C8"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:2.0.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAA4DE4E-41E9-4D6A-824A-259A10C58A33"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:2.0.0:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5A0F919-6FA5-4C28-B840-E605C7EA1C43"
            },
            {
              "criteria": "cpe:2.3:a:apache:traffic_control:2.0.0:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6EA36D0-C636-4D8F-96B3-77BF5266D9B2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}