Apache Traffic Server 5.3.x < 5.3.1 'url_sig' Plugin Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 9070


The remote caching server is affected by multiple vulnerabilities.


Apache Traffic Server, an open source caching server, is installed on the remote host.

Apache Traffic Server versions 5.3.x prior to 5.3.1 are affected by the following vulnerabilities in the 'url_sig' plugin :

- An out-of-bounds access error exists that is triggered when handling a specially crafted HTTP request. An unauthenticated, remote attacker can exploit this to crash the server. (OSVDB 128881)
- A security bypass vulnerability exists due to a flaw that is triggered when handling empty secret key URLs. An unauthenticated, remote attacker can exploit this to bypass validation mechanisms, thereby gaining access to protected assets. (OSVDB 128882)


Upgrade to Apache Traffic Server 5.3.1, or later. Alternatively, disable the 'url_sig' plugin.

See Also




Plugin Details

Severity: High

ID: 9070

Family: Web Servers

Published: 2016/02/05

Modified: 2016/11/18

Dependencies: 9787

Nessus ID: 87240

Risk Information

Risk Factor: High


Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C


Base Score: 7.5

Temporal Score: 7.2


Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:traffic_server

Patch Publication Date: 2015/05/29

Vulnerability Publication Date: 2015/05/29

Reference Information

CVE: CVE-2015-3249