You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by "Sreekanth S. Nair" <sr...@egovernments.org> on 2013/10/16 11:48:14 UTC
Steps Involved in counter measurement for security issues
Hi,
Due to time and other internal constraints, we are unable to upgrade
strust2 to the latest version. So i would like to know if we use old
strust2 distro (in my case : struts2-core-2.1.2), what are the counter
measurement need to taken care?
Regards
Re: Steps Involved in counter measurement for security issues
Posted by "Sreekanth S. Nair" <sr...@egovernments.org>.
I don't mean it like that, but something like a proof of concept
like http://struts.apache.org/release/2.3.x/docs/s2-016.html
--
Thanks & Regards
Srikanth
Software Developer
--------------------------------
eGovernments Foundations
www.egovernments.org
Mob : 9980078913
--------------------------------
On Wed, Oct 16, 2013 at 4:30 PM, Lukasz Lenart <lu...@apache.org>wrote:
> 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > Test Case to test the security vulnerability (major ones) in
> > struts2-core-2.1.2.
>
> Everything you can find is in Struts repository, it's Open Source not
> a close code software ;-)
>
> And there is no the "test" which magically checks security
> vulnerabilities, even security scans we get from time to time are
> mostly useless without deep knowledge of Struts internals (tests/scans
> don't perform impact analysis). If you know that tool, I will be happy
> to use it.
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
Re: Steps Involved in counter measurement for security issues
Posted by Lukasz Lenart <lu...@apache.org>.
2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> Test Case to test the security vulnerability (major ones) in
> struts2-core-2.1.2.
Everything you can find is in Struts repository, it's Open Source not
a close code software ;-)
And there is no the "test" which magically checks security
vulnerabilities, even security scans we get from time to time are
mostly useless without deep knowledge of Struts internals (tests/scans
don't perform impact analysis). If you know that tool, I will be happy
to use it.
Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Steps Involved in counter measurement for security issues
Posted by "Sreekanth S. Nair" <sr...@egovernments.org>.
Thanks Eric and Martin for your valuable information, we already have high
security backed network, server and application configuration. Was just
worried about underlying security issues with struts2.
--
Thanks & Regards
Srikanth
Software Developer
--------------------------------
eGovernments Foundations
www.egovernments.org
Mob : 9980078913
--------------------------------
On Thu, Oct 17, 2013 at 4:33 AM, Martin Gainty <mg...@hotmail.com> wrote:
> all initial points of contact to your site should go thru a login process
> with a public key backed by a cert provided by vendor(you)
>
>
>
> if the cert was self-signed or the key is forged you should return a 401
> if the JSSE Key exchange is successful then yourm session will be
> assigned a secure token valid only for that Session
>
> and you will now exchange information on SSLv3/TLS Transport which ever
> connector is assigned to handle Secure Traffic
>
>
> The assigned Session-Token would "follow you" thru the system and if your
> tokens Principal was not in Role for the page or resource then client sees
> a 403ed (Forbidden) coming from you
> if ANYTHING does happen to your Session (invalidate or timeout) ...you
> invalidate the secure Token as well
>
> attempts to hack the Token by reading cookies wouldnt work either as each
> assigned Token is calc'ed off of JSESSION-ID by an algo than changes at
> random intervals
> SSLv3/TLS algos change on random intervals..so a cipher/algo worked for
> One session would not work the next session
>
> Both Encryption and Decryption Algorithms as well as their respective Salt
> length would change at random intervals
> If you are a Math whiz and you developed an algo SSL/TLS encrypt algo
> going up it would not work for the algo coming down ...Each entity's update
> schedule is orthogonal meaning that any entity cannot and should not
> necessarily be able to be derived from another known entity (by
> conventional means)
>
> Moreover since most crypto algos are migrating from symmetric (same algo
> for encryption and decryption) to asymetric (differing algos for encryption
> and decryption) the work you put into creating one non-repudiating algo for
> encrypting does not necessarily dovetail to crack'ing the second algo...
> http://en.wikipedia.org/wiki/Assymetric_key_cryptography
>
> the algos can be and are oftentimes different as seen here
>
> Browser->Algo1->Server
>
> vs
>
> Browser<-Algo2<--Server
>
>
>
> "how bad strust2 vulnerability is"...
>
> last time i checked this is not "strust2" list
>
>
> Regards,
> Martin
> ______________________________________________
>
>
>
>
>
>
> > Date: Wed, 16 Oct 2013 08:21:28 -0400
> > From: EREED2@MAIL.NYSED.GOV
> > To: user@struts.apache.org
> > Subject: Re: Steps Involved in counter measurement for security issues
> >
> > First of all, security on web applications is of a concern but not as
> > much as one would think.
> >
> > To find all the security vulnerabilities within any application, or
> > framework, one would find all the entry points which allow user
> > provided data. This could be a field, a protocol, etc. and then one
> > would "fuzz" this process until the program crashed.
> >
> > Not only does a hacker need to crash the program, but hacking also
> > requires knowledge by the attacker of the underlying operating system
> > and what version it is. Most web applications run in a virtual
> > environment with proxies between the real server and the user, so just
> > finding out what to attack is hard if the network is properly
> > configured.
> >
> > Certainly something to consider but you will probably never find all
> > the vulnerabilities, it's a much better approach to monitor your
> > network, and know your underlying systems.
> >
> > Even though struts can be hacked, look at all those .jar files you
> > included and run on your server with high level permissions. Those too
> > can be full of exploits and most of those libs are just downloaded from
> > the net by amateur developers.
> >
> > Eric Reed
> > New York State Department of Education
> >
> >
> >
> >
> >
> > >>> Lukasz Lenart <lu...@apache.org> 10/16/2013 7:12 AM >>>
> > Ok, so the only option is got through each security bulletin and check
> > provided Proof-of-Concept if it affects your application. And DMI
> > isn't a problem if used wise.
> >
> > https://cwiki.apache.org/confluence/display/WW/Security+Bulletins
> >
> > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > > Thanks Lukazs, the problem i'm facing now is our product is so huge
> > to do a
> > > migration and running mainly on DMI. I'm unable to convince my top
> > > management about how bad strust2 vulnerability is (since i dont know
> > how to
> > > replicate the vulnerability). So I have no choice other than option
> > 2.
> > >
> > > --
> > > Thanks & Regards
> > > Srikanth
> > > Software Developer
> > > --------------------------------
> > > eGovernments Foundations
> > > www.egovernments.org
> > > Mob : 9980078913
> > > --------------------------------
> > >
> > >
> > > On Wed, Oct 16, 2013 at 4:22 PM, Umesh Awasthi
> > <um...@gmail.com>wrote:
> > >
> > >> I do not think that is possible.
> > >> You have 2 options
> > >>
> > >> 1. Upgrade you struts2 version.
> > >> 2. Go through security vulnerability and see what was there and
> > create test
> > >> cases to see what exactly is happening and fix them by checking
> > patches.
> > >>
> > >> But IMO, upgrading to latest version is much more flexible and less
> > time
> > >> consuming than going through each and every vulnerability and
> > applying
> > >> fixes for them.
> > >>
> > >>
> > >> On Wed, Oct 16, 2013 at 4:17 PM, Sreekanth S. Nair <
> > >> sreekanth.nair@egovernments.org> wrote:
> > >>
> > >> > Test Case to test the security vulnerability (major ones) in
> > >> > struts2-core-2.1.2.
> > >> >
> > >> > --
> > >> > Thanks & Regards
> > >> > Srikanth
> > >> > Software Developer
> > >> > --------------------------------
> > >> > eGovernments Foundations
> > >> > www.egovernments.org
> > >> > Mob : 9980078913
> > >> > --------------------------------
> > >> >
> > >> >
> > >> > On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart
> > <lukaszlenart@apache.org
> > >> > >wrote:
> > >> >
> > >> > > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > >> > > > One more doubt, does this security vulnerability is able to
> > bring
> > >> down
> > >> > > the
> > >> > > > server :-) ? If we authorize ourselves to apache, is it
> > possible for
> > >> > > struts
> > >> > > > team to give us test case to check the vulnerability?
> > >> > >
> > >> > > What you mean by that? What test case you refer to?
> > >> > >
> > >> > >
> > >> > > Regards
> > >> > > --
> > >> > > Łukasz
> > >> > > + 48 606 323 122 http://www.lenart.org.pl/
> > >> > >
> > >> > >
> > ---------------------------------------------------------------------
> > >> > > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> > >> > > For additional commands, e-mail: user-help@struts.apache.org
> > >> > >
> > >> > >
> > >> >
> > >>
> > >>
> > >>
> > >> --
> > >> With Regards
> > >> Umesh Awasthi
> > >> http://www.travellingrants.com/
> > >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> > For additional commands, e-mail: user-help@struts.apache.org
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> > For additional commands, e-mail: user-help@struts.apache.org
> >
>
>
RE: Steps Involved in counter measurement for security issues
Posted by Martin Gainty <mg...@hotmail.com>.
all initial points of contact to your site should go thru a login process with a public key backed by a cert provided by vendor(you)
if the cert was self-signed or the key is forged you should return a 401
if the JSSE Key exchange is successful then yourm session will be assigned a secure token valid only for that Session
and you will now exchange information on SSLv3/TLS Transport which ever connector is assigned to handle Secure Traffic
The assigned Session-Token would "follow you" thru the system and if your tokens Principal was not in Role for the page or resource then client sees a 403ed (Forbidden) coming from you
if ANYTHING does happen to your Session (invalidate or timeout) ...you invalidate the secure Token as well
attempts to hack the Token by reading cookies wouldnt work either as each assigned Token is calc'ed off of JSESSION-ID by an algo than changes at random intervals
SSLv3/TLS algos change on random intervals..so a cipher/algo worked for One session would not work the next session
Both Encryption and Decryption Algorithms as well as their respective Salt length would change at random intervals
If you are a Math whiz and you developed an algo SSL/TLS encrypt algo going up it would not work for the algo coming down ...Each entity's update schedule is orthogonal meaning that any entity cannot and should not necessarily be able to be derived from another known entity (by conventional means)
Moreover since most crypto algos are migrating from symmetric (same algo for encryption and decryption) to asymetric (differing algos for encryption and decryption) the work you put into creating one non-repudiating algo for encrypting does not necessarily dovetail to crack'ing the second algo...http://en.wikipedia.org/wiki/Assymetric_key_cryptography
the algos can be and are oftentimes different as seen here
Browser->Algo1->Server
vs
Browser<-Algo2<--Server
"how bad strust2 vulnerability is"...
last time i checked this is not "strust2" list
Regards,
Martin
______________________________________________
> Date: Wed, 16 Oct 2013 08:21:28 -0400
> From: EREED2@MAIL.NYSED.GOV
> To: user@struts.apache.org
> Subject: Re: Steps Involved in counter measurement for security issues
>
> First of all, security on web applications is of a concern but not as
> much as one would think.
>
> To find all the security vulnerabilities within any application, or
> framework, one would find all the entry points which allow user
> provided data. This could be a field, a protocol, etc. and then one
> would "fuzz" this process until the program crashed.
>
> Not only does a hacker need to crash the program, but hacking also
> requires knowledge by the attacker of the underlying operating system
> and what version it is. Most web applications run in a virtual
> environment with proxies between the real server and the user, so just
> finding out what to attack is hard if the network is properly
> configured.
>
> Certainly something to consider but you will probably never find all
> the vulnerabilities, it's a much better approach to monitor your
> network, and know your underlying systems.
>
> Even though struts can be hacked, look at all those .jar files you
> included and run on your server with high level permissions. Those too
> can be full of exploits and most of those libs are just downloaded from
> the net by amateur developers.
>
> Eric Reed
> New York State Department of Education
>
>
>
>
>
> >>> Lukasz Lenart <lu...@apache.org> 10/16/2013 7:12 AM >>>
> Ok, so the only option is got through each security bulletin and check
> provided Proof-of-Concept if it affects your application. And DMI
> isn't a problem if used wise.
>
> https://cwiki.apache.org/confluence/display/WW/Security+Bulletins
>
> 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > Thanks Lukazs, the problem i'm facing now is our product is so huge
> to do a
> > migration and running mainly on DMI. I'm unable to convince my top
> > management about how bad strust2 vulnerability is (since i dont know
> how to
> > replicate the vulnerability). So I have no choice other than option
> 2.
> >
> > --
> > Thanks & Regards
> > Srikanth
> > Software Developer
> > --------------------------------
> > eGovernments Foundations
> > www.egovernments.org
> > Mob : 9980078913
> > --------------------------------
> >
> >
> > On Wed, Oct 16, 2013 at 4:22 PM, Umesh Awasthi
> <um...@gmail.com>wrote:
> >
> >> I do not think that is possible.
> >> You have 2 options
> >>
> >> 1. Upgrade you struts2 version.
> >> 2. Go through security vulnerability and see what was there and
> create test
> >> cases to see what exactly is happening and fix them by checking
> patches.
> >>
> >> But IMO, upgrading to latest version is much more flexible and less
> time
> >> consuming than going through each and every vulnerability and
> applying
> >> fixes for them.
> >>
> >>
> >> On Wed, Oct 16, 2013 at 4:17 PM, Sreekanth S. Nair <
> >> sreekanth.nair@egovernments.org> wrote:
> >>
> >> > Test Case to test the security vulnerability (major ones) in
> >> > struts2-core-2.1.2.
> >> >
> >> > --
> >> > Thanks & Regards
> >> > Srikanth
> >> > Software Developer
> >> > --------------------------------
> >> > eGovernments Foundations
> >> > www.egovernments.org
> >> > Mob : 9980078913
> >> > --------------------------------
> >> >
> >> >
> >> > On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart
> <lukaszlenart@apache.org
> >> > >wrote:
> >> >
> >> > > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> >> > > > One more doubt, does this security vulnerability is able to
> bring
> >> down
> >> > > the
> >> > > > server :-) ? If we authorize ourselves to apache, is it
> possible for
> >> > > struts
> >> > > > team to give us test case to check the vulnerability?
> >> > >
> >> > > What you mean by that? What test case you refer to?
> >> > >
> >> > >
> >> > > Regards
> >> > > --
> >> > > Łukasz
> >> > > + 48 606 323 122 http://www.lenart.org.pl/
> >> > >
> >> > >
> ---------------------------------------------------------------------
> >> > > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> >> > > For additional commands, e-mail: user-help@struts.apache.org
> >> > >
> >> > >
> >> >
> >>
> >>
> >>
> >> --
> >> With Regards
> >> Umesh Awasthi
> >> http://www.travellingrants.com/
> >>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
Re: Steps Involved in counter measurement for security issues
Posted by Eric Reed <ER...@MAIL.NYSED.GOV>.
First of all, security on web applications is of a concern but not as
much as one would think.
To find all the security vulnerabilities within any application, or
framework, one would find all the entry points which allow user
provided data. This could be a field, a protocol, etc. and then one
would "fuzz" this process until the program crashed.
Not only does a hacker need to crash the program, but hacking also
requires knowledge by the attacker of the underlying operating system
and what version it is. Most web applications run in a virtual
environment with proxies between the real server and the user, so just
finding out what to attack is hard if the network is properly
configured.
Certainly something to consider but you will probably never find all
the vulnerabilities, it's a much better approach to monitor your
network, and know your underlying systems.
Even though struts can be hacked, look at all those .jar files you
included and run on your server with high level permissions. Those too
can be full of exploits and most of those libs are just downloaded from
the net by amateur developers.
Eric Reed
New York State Department of Education
>>> Lukasz Lenart <lu...@apache.org> 10/16/2013 7:12 AM >>>
Ok, so the only option is got through each security bulletin and check
provided Proof-of-Concept if it affects your application. And DMI
isn't a problem if used wise.
https://cwiki.apache.org/confluence/display/WW/Security+Bulletins
2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> Thanks Lukazs, the problem i'm facing now is our product is so huge
to do a
> migration and running mainly on DMI. I'm unable to convince my top
> management about how bad strust2 vulnerability is (since i dont know
how to
> replicate the vulnerability). So I have no choice other than option
2.
>
> --
> Thanks & Regards
> Srikanth
> Software Developer
> --------------------------------
> eGovernments Foundations
> www.egovernments.org
> Mob : 9980078913
> --------------------------------
>
>
> On Wed, Oct 16, 2013 at 4:22 PM, Umesh Awasthi
<um...@gmail.com>wrote:
>
>> I do not think that is possible.
>> You have 2 options
>>
>> 1. Upgrade you struts2 version.
>> 2. Go through security vulnerability and see what was there and
create test
>> cases to see what exactly is happening and fix them by checking
patches.
>>
>> But IMO, upgrading to latest version is much more flexible and less
time
>> consuming than going through each and every vulnerability and
applying
>> fixes for them.
>>
>>
>> On Wed, Oct 16, 2013 at 4:17 PM, Sreekanth S. Nair <
>> sreekanth.nair@egovernments.org> wrote:
>>
>> > Test Case to test the security vulnerability (major ones) in
>> > struts2-core-2.1.2.
>> >
>> > --
>> > Thanks & Regards
>> > Srikanth
>> > Software Developer
>> > --------------------------------
>> > eGovernments Foundations
>> > www.egovernments.org
>> > Mob : 9980078913
>> > --------------------------------
>> >
>> >
>> > On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart
<lukaszlenart@apache.org
>> > >wrote:
>> >
>> > > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
>> > > > One more doubt, does this security vulnerability is able to
bring
>> down
>> > > the
>> > > > server :-) ? If we authorize ourselves to apache, is it
possible for
>> > > struts
>> > > > team to give us test case to check the vulnerability?
>> > >
>> > > What you mean by that? What test case you refer to?
>> > >
>> > >
>> > > Regards
>> > > --
>> > > Łukasz
>> > > + 48 606 323 122 http://www.lenart.org.pl/
>> > >
>> > >
---------------------------------------------------------------------
>> > > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> > > For additional commands, e-mail: user-help@struts.apache.org
>> > >
>> > >
>> >
>>
>>
>>
>> --
>> With Regards
>> Umesh Awasthi
>> http://www.travellingrants.com/
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Steps Involved in counter measurement for security issues
Posted by Lukasz Lenart <lu...@apache.org>.
Ok, so the only option is got through each security bulletin and check
provided Proof-of-Concept if it affects your application. And DMI
isn't a problem if used wise.
https://cwiki.apache.org/confluence/display/WW/Security+Bulletins
2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> Thanks Lukazs, the problem i'm facing now is our product is so huge to do a
> migration and running mainly on DMI. I'm unable to convince my top
> management about how bad strust2 vulnerability is (since i dont know how to
> replicate the vulnerability). So I have no choice other than option 2.
>
> --
> Thanks & Regards
> Srikanth
> Software Developer
> --------------------------------
> eGovernments Foundations
> www.egovernments.org
> Mob : 9980078913
> --------------------------------
>
>
> On Wed, Oct 16, 2013 at 4:22 PM, Umesh Awasthi <um...@gmail.com>wrote:
>
>> I do not think that is possible.
>> You have 2 options
>>
>> 1. Upgrade you struts2 version.
>> 2. Go through security vulnerability and see what was there and create test
>> cases to see what exactly is happening and fix them by checking patches.
>>
>> But IMO, upgrading to latest version is much more flexible and less time
>> consuming than going through each and every vulnerability and applying
>> fixes for them.
>>
>>
>> On Wed, Oct 16, 2013 at 4:17 PM, Sreekanth S. Nair <
>> sreekanth.nair@egovernments.org> wrote:
>>
>> > Test Case to test the security vulnerability (major ones) in
>> > struts2-core-2.1.2.
>> >
>> > --
>> > Thanks & Regards
>> > Srikanth
>> > Software Developer
>> > --------------------------------
>> > eGovernments Foundations
>> > www.egovernments.org
>> > Mob : 9980078913
>> > --------------------------------
>> >
>> >
>> > On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart <lukaszlenart@apache.org
>> > >wrote:
>> >
>> > > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
>> > > > One more doubt, does this security vulnerability is able to bring
>> down
>> > > the
>> > > > server :-) ? If we authorize ourselves to apache, is it possible for
>> > > struts
>> > > > team to give us test case to check the vulnerability?
>> > >
>> > > What you mean by that? What test case you refer to?
>> > >
>> > >
>> > > Regards
>> > > --
>> > > Łukasz
>> > > + 48 606 323 122 http://www.lenart.org.pl/
>> > >
>> > > ---------------------------------------------------------------------
>> > > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
>> > > For additional commands, e-mail: user-help@struts.apache.org
>> > >
>> > >
>> >
>>
>>
>>
>> --
>> With Regards
>> Umesh Awasthi
>> http://www.travellingrants.com/
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Steps Involved in counter measurement for security issues
Posted by "Sreekanth S. Nair" <sr...@egovernments.org>.
Thanks Lukazs, the problem i'm facing now is our product is so huge to do a
migration and running mainly on DMI. I'm unable to convince my top
management about how bad strust2 vulnerability is (since i dont know how to
replicate the vulnerability). So I have no choice other than option 2.
--
Thanks & Regards
Srikanth
Software Developer
--------------------------------
eGovernments Foundations
www.egovernments.org
Mob : 9980078913
--------------------------------
On Wed, Oct 16, 2013 at 4:22 PM, Umesh Awasthi <um...@gmail.com>wrote:
> I do not think that is possible.
> You have 2 options
>
> 1. Upgrade you struts2 version.
> 2. Go through security vulnerability and see what was there and create test
> cases to see what exactly is happening and fix them by checking patches.
>
> But IMO, upgrading to latest version is much more flexible and less time
> consuming than going through each and every vulnerability and applying
> fixes for them.
>
>
> On Wed, Oct 16, 2013 at 4:17 PM, Sreekanth S. Nair <
> sreekanth.nair@egovernments.org> wrote:
>
> > Test Case to test the security vulnerability (major ones) in
> > struts2-core-2.1.2.
> >
> > --
> > Thanks & Regards
> > Srikanth
> > Software Developer
> > --------------------------------
> > eGovernments Foundations
> > www.egovernments.org
> > Mob : 9980078913
> > --------------------------------
> >
> >
> > On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart <lukaszlenart@apache.org
> > >wrote:
> >
> > > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > > > One more doubt, does this security vulnerability is able to bring
> down
> > > the
> > > > server :-) ? If we authorize ourselves to apache, is it possible for
> > > struts
> > > > team to give us test case to check the vulnerability?
> > >
> > > What you mean by that? What test case you refer to?
> > >
> > >
> > > Regards
> > > --
> > > Łukasz
> > > + 48 606 323 122 http://www.lenart.org.pl/
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> > > For additional commands, e-mail: user-help@struts.apache.org
> > >
> > >
> >
>
>
>
> --
> With Regards
> Umesh Awasthi
> http://www.travellingrants.com/
>
Re: Steps Involved in counter measurement for security issues
Posted by Umesh Awasthi <um...@gmail.com>.
I do not think that is possible.
You have 2 options
1. Upgrade you struts2 version.
2. Go through security vulnerability and see what was there and create test
cases to see what exactly is happening and fix them by checking patches.
But IMO, upgrading to latest version is much more flexible and less time
consuming than going through each and every vulnerability and applying
fixes for them.
On Wed, Oct 16, 2013 at 4:17 PM, Sreekanth S. Nair <
sreekanth.nair@egovernments.org> wrote:
> Test Case to test the security vulnerability (major ones) in
> struts2-core-2.1.2.
>
> --
> Thanks & Regards
> Srikanth
> Software Developer
> --------------------------------
> eGovernments Foundations
> www.egovernments.org
> Mob : 9980078913
> --------------------------------
>
>
> On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart <lukaszlenart@apache.org
> >wrote:
>
> > 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > > One more doubt, does this security vulnerability is able to bring down
> > the
> > > server :-) ? If we authorize ourselves to apache, is it possible for
> > struts
> > > team to give us test case to check the vulnerability?
> >
> > What you mean by that? What test case you refer to?
> >
> >
> > Regards
> > --
> > Łukasz
> > + 48 606 323 122 http://www.lenart.org.pl/
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> > For additional commands, e-mail: user-help@struts.apache.org
> >
> >
>
--
With Regards
Umesh Awasthi
http://www.travellingrants.com/
Re: Steps Involved in counter measurement for security issues
Posted by "Sreekanth S. Nair" <sr...@egovernments.org>.
Test Case to test the security vulnerability (major ones) in
struts2-core-2.1.2.
--
Thanks & Regards
Srikanth
Software Developer
--------------------------------
eGovernments Foundations
www.egovernments.org
Mob : 9980078913
--------------------------------
On Wed, Oct 16, 2013 at 4:15 PM, Lukasz Lenart <lu...@apache.org>wrote:
> 2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> > One more doubt, does this security vulnerability is able to bring down
> the
> > server :-) ? If we authorize ourselves to apache, is it possible for
> struts
> > team to give us test case to check the vulnerability?
>
> What you mean by that? What test case you refer to?
>
>
> Regards
> --
> Łukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
Re: Steps Involved in counter measurement for security issues
Posted by Lukasz Lenart <lu...@apache.org>.
2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> One more doubt, does this security vulnerability is able to bring down the
> server :-) ? If we authorize ourselves to apache, is it possible for struts
> team to give us test case to check the vulnerability?
What you mean by that? What test case you refer to?
Regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Steps Involved in counter measurement for security issues
Posted by "Sreekanth S. Nair" <sr...@egovernments.org>.
One more doubt, does this security vulnerability is able to bring down the
server :-) ? If we authorize ourselves to apache, is it possible for struts
team to give us test case to check the vulnerability?
--
Thanks & Regards
Srikanth
Software Developer
--------------------------------
eGovernments Foundations
www.egovernments.org
Mob : 9980078913
--------------------------------
On Wed, Oct 16, 2013 at 3:34 PM, Sreekanth S. Nair <
sreekanth.nair@egovernments.org> wrote:
> Hi,
> Thanks Lukazs, but that's too much of task to compare rather i can
> migrate ;-). Thanks Antonios, i will refer those links.
>
>
>
> --
> Thanks & Regards
> sreekanth
> --------------------------------
>
>
> On Wed, Oct 16, 2013 at 3:25 PM, Antonios Gkogkakis <gk...@tcd.ie>wrote:
>
>> Hi Sreekanth,
>>
>> Lukasz beat me!
>>
>> If you don't want to upgrade you should at least check the security
>> bulletins
>> http://struts.apache.org/release/2.2.x/docs/security-bulletins.html
>> http://struts.apache.org/release/2.3.x/docs/security-bulletins.html
>>
>> see which vulnerabilities affect you and follow the instructions to
>> resolve
>> them.
>>
>>
>>
>> On 16 October 2013 10:48, Sreekanth S. Nair <
>> sreekanth.nair@egovernments.org
>> > wrote:
>>
>> > Hi,
>> > Due to time and other internal constraints, we are unable to upgrade
>> > strust2 to the latest version. So i would like to know if we use old
>> > strust2 distro (in my case : struts2-core-2.1.2), what are the counter
>> > measurement need to taken care?
>> >
>> > Regards
>> >
>>
>
>
Re: Steps Involved in counter measurement for security issues
Posted by "Sreekanth S. Nair" <sr...@egovernments.org>.
Hi,
Thanks Lukazs, but that's too much of task to compare rather i can
migrate ;-). Thanks Antonios, i will refer those links.
--
Thanks & Regards
sreekanth
--------------------------------
On Wed, Oct 16, 2013 at 3:25 PM, Antonios Gkogkakis <gk...@tcd.ie> wrote:
> Hi Sreekanth,
>
> Lukasz beat me!
>
> If you don't want to upgrade you should at least check the security
> bulletins
> http://struts.apache.org/release/2.2.x/docs/security-bulletins.html
> http://struts.apache.org/release/2.3.x/docs/security-bulletins.html
>
> see which vulnerabilities affect you and follow the instructions to resolve
> them.
>
>
>
> On 16 October 2013 10:48, Sreekanth S. Nair <
> sreekanth.nair@egovernments.org
> > wrote:
>
> > Hi,
> > Due to time and other internal constraints, we are unable to upgrade
> > strust2 to the latest version. So i would like to know if we use old
> > strust2 distro (in my case : struts2-core-2.1.2), what are the counter
> > measurement need to taken care?
> >
> > Regards
> >
>
Re: Steps Involved in counter measurement for security issues
Posted by Antonios Gkogkakis <gk...@tcd.ie>.
Hi Sreekanth,
Lukasz beat me!
If you don't want to upgrade you should at least check the security
bulletins
http://struts.apache.org/release/2.2.x/docs/security-bulletins.html
http://struts.apache.org/release/2.3.x/docs/security-bulletins.html
see which vulnerabilities affect you and follow the instructions to resolve
them.
On 16 October 2013 10:48, Sreekanth S. Nair <sreekanth.nair@egovernments.org
> wrote:
> Hi,
> Due to time and other internal constraints, we are unable to upgrade
> strust2 to the latest version. So i would like to know if we use old
> strust2 distro (in my case : struts2-core-2.1.2), what are the counter
> measurement need to taken care?
>
> Regards
>
Re: Steps Involved in counter measurement for security issues
Posted by Lukasz Lenart <lu...@apache.org>.
Though task ;-)
The only option is to analyse what kind of vulnerabilities were
discovered after and which of them can potentially affect your version
(given vulnerable functionality exists in your version you use right
now).
https://cwiki.apache.org/confluence/display/WW/Migration+Guide
2013/10/16 Sreekanth S. Nair <sr...@egovernments.org>:
> Hi,
> Due to time and other internal constraints, we are unable to upgrade
> strust2 to the latest version. So i would like to know if we use old
> strust2 distro (in my case : struts2-core-2.1.2), what are the counter
> measurement need to taken care?
>
> Regards
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org