Apache Traffic Server 5.3.x < 5.3.1 'url_sig' Plugin Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 9070

Synopsis

The remote caching server is affected by multiple vulnerabilities.

Description

Apache Traffic Server, an open source caching server, is installed on the remote host.

Apache Traffic Server versions 5.3.x prior to 5.3.1 are affected by the following vulnerabilities in the 'url_sig' plugin :

- An out-of-bounds access error exists that is triggered when handling a specially crafted HTTP request. An unauthenticated, remote attacker can exploit this to crash the server. (OSVDB 128881)
- A security bypass vulnerability exists due to a flaw that is triggered when handling empty secret key URLs. An unauthenticated, remote attacker can exploit this to bypass validation mechanisms, thereby gaining access to protected assets. (OSVDB 128882)

Solution

Upgrade to Apache Traffic Server 5.3.1, or later. Alternatively, disable the 'url_sig' plugin.

See Also

http://www.nessus.org/u?b450befb

http://www.nessus.org/u?c77e9f28

http://trafficserver.apache.org

Plugin Details

Severity: High

ID: 9070

Family: Web Servers

Published: 2016/02/05

Modified: 2016/11/18

Dependencies: 9787

Nessus ID: 87240

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 7.5

Temporal Score: 7.2

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:traffic_server

Patch Publication Date: 2015/05/29

Vulnerability Publication Date: 2015/05/29

Reference Information

CVE: CVE-2015-3249