You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ofbiz.apache.org by Jacques Le Roux <ja...@les7arts.com> on 2017/09/20 10:29:29 UTC
Fwd: [SECURITY] Apache Tomcat Possible additional RCE via JSP
upload
Hi,
I checked, from my investigation we are safe
* no default servlet is configured with readonly="false" in any of the web.xml files
* the only iCalendar WebDAV Servlet is not configured with readonly="false"
https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/servlets/WebdavServlet.html
I think we need to let know our users about this possible vulnerability since Tomcat in embedded in OFBiz
Jacques
-------- Message transféré --------
Sujet : [SECURITY] Apache Tomcat Possible additional RCE via JSP upload
Date : Wed, 20 Sep 2017 09:25:35 +0100
De : Mark Thomas <ma...@apache.org>
Pour : Tomcat Users List <us...@tomcat.apache.org>
Copie à : Tomcat Developers List <de...@tomcat.apache.org>, announce@tomcat.apache.org <an...@tomcat.apache.org>, announce@apache.org
All,
Following the announcement of CVE-2017-12615 [1], the Apache Tomcat
Security Team has received multiple reports that a similar vulnerability
exists in all current Tomcat versions and affects all operating systems.
Unfortunately, one of these reports was made via the public bug tracker
[2] rather than responsibly via the Tomcat Security Team's private
mailing list [3].
We have not yet completed our investigation of these reports but, based
on the volume, and our initial investigation they appear to be valid.
>From an initial analysis of the reports received, the vulnerability only
affects the following configurations:
Default Servlet
- Default Servlet configured with readonly="false"
AND
- Untrusted users are permitted to perform HTTP PUT requests
WebDAV Servlet
- WebDAV Servlet configured with readonly="false"
AND
- Untrusted users are permitted to perform HTTP PUT requests
AND
- The documented advice not to map the WebDAV servlet as the Default
servlet has been ignored
Please note that:
- The WebDAV servlet is disabled by default
- The default value for the readonly parameter is true for both the
Default servlet and the WebDAV servlet
Therefore, a default Tomcat installation is not affected by this
potential vulnerability.
Based on our understanding to date, the potential vulnerability may be
mitigated by any of the following:
- setting readonly to true for the Default servlet and WebDAV servlet
- blocking HTTP methods that permit resource modification for untrusted
users
We will provide updates to the community as our investigation of these
reports continues.
Mark
on behalf of the Apache Tomcat Security Team
[1] http://markmail.org/message/xqfchebiy6fjmvjz
[2] https://bz.apache.org/bugzilla/show_bug.cgi?id=61542
[3] http://tomcat.apache.org/security.html
[FYI] Fwd: Fwd: [SECURITY] Apache Tomcat Possible additional RCE
via JSP upload
Posted by Jacques Le Roux <ja...@les7arts.com>.
This is for your information in case you would use a WebDAV Servlet with readonly="false"
Jacques
-------- Message transféré --------
Sujet : Fwd: [SECURITY] Apache Tomcat Possible additional RCE via JSP upload
Date : Wed, 20 Sep 2017 12:29:29 +0200
De : Jacques Le Roux <ja...@les7arts.com>
Répondre à : dev@ofbiz.apache.org
Organisation : Les Arts Informatiques
Pour : dev@ofbiz.apache.org <de...@ofbiz.apache.org>
Hi,
I checked, from my investigation we are safe
* no default servlet is configured with readonly="false" in any of the web.xml files
* the only iCalendar WebDAV Servlet is not configured with readonly="false"
https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/servlets/WebdavServlet.html
I think we need to let know our users about this possible vulnerability since Tomcat in embedded in OFBiz
Jacques
-------- Message transféré --------
Sujet : [SECURITY] Apache Tomcat Possible additional RCE via JSP upload
Date : Wed, 20 Sep 2017 09:25:35 +0100
De : Mark Thomas <ma...@apache.org>
Pour : Tomcat Users List <us...@tomcat.apache.org>
Copie à : Tomcat Developers List <de...@tomcat.apache.org>, announce@tomcat.apache.org <an...@tomcat.apache.org>, announce@apache.org
All,
Following the announcement of CVE-2017-12615 [1], the Apache Tomcat
Security Team has received multiple reports that a similar vulnerability
exists in all current Tomcat versions and affects all operating systems.
Unfortunately, one of these reports was made via the public bug tracker
[2] rather than responsibly via the Tomcat Security Team's private
mailing list [3].
We have not yet completed our investigation of these reports but, based
on the volume, and our initial investigation they appear to be valid.
>From an initial analysis of the reports received, the vulnerability only
affects the following configurations:
Default Servlet
- Default Servlet configured with readonly="false"
AND
- Untrusted users are permitted to perform HTTP PUT requests
WebDAV Servlet
- WebDAV Servlet configured with readonly="false"
AND
- Untrusted users are permitted to perform HTTP PUT requests
AND
- The documented advice not to map the WebDAV servlet as the Default
servlet has been ignored
Please note that:
- The WebDAV servlet is disabled by default
- The default value for the readonly parameter is true for both the
Default servlet and the WebDAV servlet
Therefore, a default Tomcat installation is not affected by this
potential vulnerability.
Based on our understanding to date, the potential vulnerability may be
mitigated by any of the following:
- setting readonly to true for the Default servlet and WebDAV servlet
- blocking HTTP methods that permit resource modification for untrusted
users
We will provide updates to the community as our investigation of these
reports continues.
Mark
on behalf of the Apache Tomcat Security Team
[1] http://markmail.org/message/xqfchebiy6fjmvjz
[2] https://bz.apache.org/bugzilla/show_bug.cgi?id=61542
[3] http://tomcat.apache.org/security.html