Forum Discussion

JustCooLpOOLe's avatar
JustCooLpOOLe
Icon for Cirrocumulus rankCirrocumulus
Nov 15, 2016

Scan Failure - Redhat JBoss Enterprise

We have an applications that use this piece of software for their application. We just had a vulnerability scan run against it and it came back with the below information. The solution says to upgr...
application delivery
LTM
security
Leonardo_Accors's avatar
Leonardo_Accors
Icon for Cirrus rankCirrus
Nov 16, 2016

Hi Shann, I'm not really expert in this type of attacs. Reading documentation (https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet) I see that X-Frame-Options HTTP header can be used to protect from CVE-2015-5178. Generally speaking, I think that it is possible to insert this HEADER by an iRule in the HTTP_RESPOND event. In this way you would supply to the missing header insertion. Regarding CVE-2015-5220, you can create a iRule that in HTTP_REQUEST event, count the number of HTTP header in the request and reject the request if this number is larger than a specific limit.

 

Hope this can help.

 

regards

 

Leonardo