Apache Traffic Control: Unauthorised Access -- Remote/Unauthenticated

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3401
             CVE-2019-12405: Apache Traffic Control LDAP-based
                       authentication vulnerability
                             9 September 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          Apache Traffic Control
Publisher:        Apache Foundation
Operating System: Windows
                  UNIX variants (UNIX, Linux, OSX)
Impact/Access:    Unauthorised Access -- Remote/Unauthenticated
Resolution:       Patch/Upgrade
CVE Names:        CVE-2019-12405  

- --------------------------BEGIN INCLUDED TEXT--------------------

CVE-2019-12405: Apache Traffic Control LDAP-based authentication vulnerability

Severity: Critical

Vendor: The Apache Software Foundation

Versions affected:

Traffic Control 3.0.0

Traffic Control 3.0.1

Description:

The Traffic Ops API component of the Apache Traffic Control project is

vulnerable to improper authentication when LDAP is enabled. Given a username

for a user that can be authenticated via LDAP, it is possible to improperly


authenticate as that user without that user's correct password.

Mitigation:

3.x users should upgrade to 3.0.2.

If the upgrade cannot be done immediately, LDAP authentication can be disabled

by removing the Traffic Ops LDAP configuration file -- ldap.conf -- in order to


mitigate the vulnerability until an upgrade to 3.0.2 can be performed.



References:

    Downloads:

        http://trafficcontrol.apache.org/releases/

    CVE:

        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12405

    Project security:

        http://trafficcontrol.apache.org/security/

- --

Thanks,

Rawlin

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXXWShGaOgq3Tt24GAQhqqRAAuGA3MGe4uhVs+4lYdTzVEsDjQyHH1dtG
0ZuQsCDSlv7DqJ3Vkunc28Zw7A7voFKwgNUvxLaZp4rwmlBclVVQ04JjauVzz1AG
fsMXX94m8YuLVBr9TccuOVKGBT7eYq8mg4JnrUiOyOpCepdtELEnFtaxYH0QIgCl
71kHcEu9bkqyvOiS67L2/5XvL79Vqe2mphB9R+bkpTXtOGUIRxLGhf6pLNy/wWRb
rc4vk5Qyyd+6nVdCvN3XKzbjbKw7tqAm8CglvCfjAMjHsd7IB7O9r15MaLkTYVIe
Qg1s2aY204psCYaCYRud4f5gzKer1CeJBuvn4mLi7r8HjF6s3n5IBSCschC8gO2p
Gkx/8RgxTregInueQHqrRnkMfbbamKDJxToPjY2lna8P4n5c1ajbI46GFt+hJ0nV
ZKj/35EKaJmJvd4rH1bYocD6xDp53M+8c1kGp0Fsya0EkLLjjuaIp34d2BGk79km
7C0I1LvJOgAbPfQI+GtmhJO/TeJegUVnssZE63JaCOCMFrH70TEBZ3m44aW7wmQ4
OdzySgMtfFWd+bozs97UMHZ6S9l1SB/SY4ZpaoD68mW6Xa2WF6H16oZz/ei8yVkX
54PgA3dxdvMCIA+ZuNNhhGMox3oEsgJMlQYxY9V63jj//xd83aBnljW9PgRDsQZw
srmQEZJjJAQ=
=eLBG
-----END PGP SIGNATURE-----