F5 Networks BIG-IP : Apache Tomcat 6.x vulnerability (K34341852)

medium Nessus Plugin ID 107136

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.67, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (CVE-2015-5345)

Impact

A remote attacker may be able to determine the existence of restricted directories by exploiting this vulnerability.

BIG-IP/Enterprise Manager

The Tomcat service is not directly exposed to the network, as it only listens on a localhost socket with connections brokered through the Apache front-end web service.

Traffix SDC Exploitation of this vulnerability may occur if an attacker has access to the local network of the system; the Tomcat service is accessible only from the internal network.

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K34341852.

Plugin Details

Severity: Medium

ID: 107136

File Name: f5_bigip_SOL34341852.nasl

Version: 3.3

Type: local

Family: F5 Networks Local Security Checks

Published: 3/6/2018

Updated: 3/18/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_wan_optimization_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip, cpe:/h:f5:big-ip_protocol_security_manager

Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version

Patch Publication Date: 3/5/2018

Vulnerability Publication Date: 2/25/2016

Reference Information

CVE: CVE-2015-5345

Detections

Analytics