https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Bug ID: 1140314 Summary: CVE-2013-4444 tomcat: remote code execution via uploaded JSP Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: vdanen@redhat.com CC: akurtako@redhat.com, dknox@redhat.com, gmurphy@redhat.com, ivan.afonichev@gmail.com, java-sig-commits@lists.fedoraproject.org, jclere@redhat.com, jdoyle@redhat.com, krzysztof.daniel@gmail.com, lgao@redhat.com, myarboro@redhat.com, pslavice@redhat.com, rsvoboda@redhat.com, weli@redhat.com
As reported fixed in Apache Tomcat 7.0.40 [1]:
In very limited circumstances, it was possible for an attacker to upload a malicious JSP to a Tomcat server and then trigger the execution of that JSP. While Remote Code Execution would normally be viewed as a critical vulnerability, the circumstances under which this is possible are, in the view of the Tomcat security team, sufficiently limited that this vulnerability is viewed as important.
For this attack to succeed all of the following requirements must be met:
1. Using Oracle Java 1.7.0 update 25 or earlier (or any other Java implementation where java.io.File is vulnerable to null byte injection). 2. A web application must be deployed to a vulnerable version of Tomcat. 3. The web application must use the Servlet 3.0 File Upload feature. 4. A file location within a deployed web application must be writeable by the user the Tomcat process is running as. The Tomcat security documentation recommends against this. 5. A custom listener for JMX connections (e.g. the JmxRemoteListener that is not enabled by default) must be configured and be able to load classes from Tomcat's common class loader (i.e. the custom JMX listener must be placed in Tomcat's lib directory). 6. The custom JMX listener must be bound to an address other than localhost for a remote attack (it is bound to localhost by default). If the custom JMX listener is bound to localhost, a local attack will still be possible.
Note that requirements 2 and 3 may be replaced with the following requirement:
7. A web application is deployed that uses Apache Commons File Upload 1.2.1 or earlier.
In this case (requirements 1, 4, 5, 6 and 7 met) a similar vulnerability may exist on any Servlet container, not just Apache Tomcat.
This was fixed in revision 1470437. [2] (April 22, 2013)
This issue was identified by Pierre Ernst of the VMware Security Engineering, Communications and Response group (vSECR) and reported to the Tomcat security team via the Pivotal security team on 5 September 2014. It was made public on 10 September 2014.
Affects: 7.0.0 to 7.0.39
[1] http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.40 [2] http://svn.apache.org/viewvc?view=revision&revision=1470437
Statement:
This issue did not affect the versions of tomcat as shipped with Red Hat Enterprise Linux 5, 6, or 7 nor the versions of tomcat as shipped with JBoss Enterprise Web Server.
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Vincent Danen vdanen@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1140316
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Vincent Danen vdanen@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1140317
--- Comment #1 from Vincent Danen vdanen@redhat.com ---
Created tomcat tracking bugs for this issue:
Affects: epel-6 [bug 1140317]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1140317 [Bug 1140317] CVE-2013-4444 tomcat: remote code execution via uploaded JSP [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aneelica@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
--- Comment #3 from Arun Babu Neelicattu aneelica@redhat.com --- Statement:
Not Vulnerable. This issue did not affect the versions of Tomcat and JBoss Web as shipped with any Red Hat product, as this flaw was handled by Red Hat as CVE-2013-2185. This flaw is to be considered a duplicate of CVE-2013-4444.
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |40910,reported=20140910,sou |40910,reported=20140910,sou |rce=internet,cvss2=5.1/AV:N |rce=internet,cvss2=7.5/AV:N |/AC:H/Au:N/C:P/I:P/A:P,fedo |/AC:L/Au:N/C:P/I:P/A:P,fedo |ra-all/tomcat=notaffected,r |ra-all/tomcat=notaffected,r |hel-7/tomcat=notaffected,jb |hel-7/tomcat=notaffected,jb |ews-2/tomcat7=notaffected,e |ews-2/tomcat7=notaffected,e |pel-6/tomcat=affected |pel-6/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |40910,reported=20140910,sou |40910,reported=20140910,sou |rce=internet,cvss2=7.5/AV:N |rce=internet,cvss2=7.5/AV:N |/AC:L/Au:N/C:P/I:P/A:P,fedo |/AC:L/Au:N/C:P/I:P/A:P,fedo |ra-all/tomcat=notaffected,r |ra-all/tomcat=notaffected,r |hel-7/tomcat=notaffected,jb |hel-7/tomcat=notaffected,jb |ews-2/tomcat7=notaffected,e |ews-2.1.0/tomcat7=notaffect |pel-6/tomcat=affected |ed,epel-6/tomcat=affected,j | |pp-6/jbossweb=notaffected,j | |dg-6/jbossweb=notaffected,e | |ap-6/jbossweb=notaffected,j | |bews-2.1.0/tomcat7=notaffec | |ted,jboss/others=notaffecte | |d,jbews-2/tomcat6=notaffect | |ed,rhel-6/tomcat6=notaffect | |ed,jbews-1/tomcat6=notaffec | |ted,jbews-1/tomcat5=notaffe | |cted,jon-3/jbossweb=notaffe | |cted,jdv-6/jbossweb=notaffe | |cted,fsw-6/jbossweb=notaffe | |cted,soap-5/jbossweb=notaff | |ected,soap-4/jbossweb=notaf | |fected,eap-5/jbossweb=notaf | |fected,eap-4/jbossweb=notaf | |fected,jboss/others=notaffe | |cted
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Arun Babu Neelicattu aneelica@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |DUPLICATE Last Closed| |2014-09-15 03:27:39
--- Comment #4 from Arun Babu Neelicattu aneelica@redhat.com ---
*** This bug has been marked as a duplicate of bug 974813 ***
https://bugzilla.redhat.com/show_bug.cgi?id=1140314
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |40910,reported=20140910,sou |40910,reported=20140910,sou |rce=internet,cvss2=7.5/AV:N |rce=internet,cvss2=7.5/AV:N |/AC:L/Au:N/C:P/I:P/A:P,fedo |/AC:L/Au:N/C:P/I:P/A:P,rhel |ra-all/tomcat=notaffected,r |-6/tomcat6=notaffected,rhel |hel-7/tomcat=notaffected,jb |-7/tomcat=notaffected,jbews |ews-2.1.0/tomcat7=notaffect |-1/tomcat5=notaffected,jbew |ed,epel-6/tomcat=affected,j |s-1/tomcat6=notaffected,jbe |pp-6/jbossweb=notaffected,j |ws-2/tomcat6=notaffected,jb |dg-6/jbossweb=notaffected,e |ews-2/tomcat7=notaffected,e |ap-6/jbossweb=notaffected,j |ap-4/jbossweb=notaffected,e |bews-2.1.0/tomcat7=notaffec |ap-5/jbossweb=notaffected,e |ted,jboss/others=notaffecte |ap-6/jbossweb=notaffected,j |d,jbews-2/tomcat6=notaffect |pp-6/jbossweb=notaffected,j |ed,rhel-6/tomcat6=notaffect |dg-6/jbossweb=notaffected,j |ed,jbews-1/tomcat6=notaffec |on-3/jbossweb=notaffected,j |ted,jbews-1/tomcat5=notaffe |dv-6/jbossweb=notaffected,f |cted,jon-3/jbossweb=notaffe |sw-6/jbossweb=notaffected,s |cted,jdv-6/jbossweb=notaffe |oap-4/jbossweb=notaffected, |cted,fsw-6/jbossweb=notaffe |soap-5/jbossweb=notaffected |cted,soap-5/jbossweb=notaff |,jboss/others=notaffected,f |ected,soap-4/jbossweb=notaf |edora-all/tomcat=notaffecte |fected,eap-5/jbossweb=notaf |d,epel-6/tomcat=affected |fected,eap-4/jbossweb=notaf | |fected,jboss/others=notaffe | |cted |
https://bugzilla.redhat.com/show_bug.cgi?id=1140314 Bug 1140314 depends on bug 1140317, which changed state.
Bug 1140317 Summary: CVE-2013-4444 tomcat: remote code execution via uploaded JSP [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1140317
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
java-sig-commits@lists.fedoraproject.org