PT-2012-1284 · Websense+1 · Websense Web Filter+2

Published 2012-08-23 · Updated 2012-08-23 · CVE-2009-5119

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Websense Web Security versions 7.0 Websense Web Filter versions 7.0

Description The default configuration of Apache Tomcat in Websense Manager enables weak SSL ciphers in conf/server.xml. This makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.

Recommendations For Websense Web Security version 7.0, update the configuration to disable weak SSL ciphers in conf/server.xml. For Websense Web Filter version 7.0, update the configuration to disable weak SSL ciphers in conf/server.xml.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-5119

Affected Products

Apache Tomcat

Websense Web Filter

Websense Web Security

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2009-5119 · Security Note
• http://websense.com/support/article/t-kbarticle/v7-Apache-Tomcat-security-vulnerabilities-1258048503850 · Vendor Advisory