[Bug 1393454] New: CVE-2016-1000031 Apache Commons FileUpload: DiskFileItem file manipulation
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Bug ID: 1393454 Summary: CVE-2016-1000031 Apache Commons FileUpload: DiskFileItem file manipulation Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: abhgupta@redhat.com, aileenc@redhat.com, alazarot@redhat.com, alee@redhat.com, aszczucz@redhat.com, bdawidow@redhat.com, chazlett@redhat.com, csutherl@redhat.com, dmcphers@redhat.com, epp-bugs@redhat.com, etirelli@redhat.com, felias@redhat.com, gvarsami@redhat.com, hchiorea@redhat.com, hfnukal@redhat.com, hhorak@redhat.com, ivan.afonichev@gmail.com, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jerboaa@gmail.com, jialiu@redhat.com, jokerman@redhat.com, jolee@redhat.com, jorton@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, kconner@redhat.com, krzysztof.daniel@gmail.com, kseifried@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lmeyer@redhat.com, lpetrovi@redhat.com, mbaluch@redhat.com, me@coolsvap.net, miburman@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, mmraka@redhat.com, msimacek@redhat.com, mweiler@redhat.com, mwinkler@redhat.com, nwallace@redhat.com, omajid@redhat.com, pavelp@redhat.com, rrajasek@redhat.com, rwagner@redhat.com, rzhang@redhat.com, sgehwolf@redhat.com, soa-p-jira@post-office.corp.redhat.com, SpikeFedora@gmail.com, spinder@redhat.com, tcunning@redhat.com, theute@redhat.com, tiwillia@redhat.com, tkirby@redhat.com, trick@vanstaveren.us, vhalbert@redhat.com
There exists a Java Object in the Apache Commons FileUpload library that can be manipulated in such a way that when it is deserialized, it can write or copy files to disk in arbitrary locations. Furthermore, while the Object can be used alone, this new vector can be integrated with ysoserial to upload and execute binaries in a single deserialization call. This may or may not work depending on an application's implementation of the FileUpload library.
External References:
http://www.tenable.com/security/research/tra-2016-12
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2016-11-09 10:22:35
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
dereed@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dereed@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1393687
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0420,reported=20160420,sour |0420,reported=20160420,sour |ce=internet,cvss2=6.8/AV:N/ |ce=internet,cvss2=6.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:P,cvss3 |AC:M/Au:N/C:P/I:P/A:P,cvss3 |=7.3/CVSS:3.0/AV:N/AC:L/PR: |=7.3/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:L,cwe= |N/UI:N/S:U/C:L/I:L/A:L,cwe= |CWE-502,fedora-all/apache-c |CWE-502,fedora-all/apache-c |ommons-fileupload=notaffect |ommons-fileupload=notaffect |ed,epel-7/apache-commons-fi |ed,epel-7/apache-commons-fi |leupload=notaffected,fedora |leupload=notaffected,fedora |-all/tomcat=notaffected,rhe |-all/tomcat=notaffected,rhe |l-7/tomcat=notaffected,rhsc |l-7/tomcat=notaffected,rhsc |l-2.3/rh-thermostat16-apach |l-2.3/rh-thermostat16-apach |e-commons-fileupload=notaff |e-commons-fileupload=notaff |ected,amq-6/commons-fileupl |ected,amq-6/commons-fileupl |oad=notaffected,brms-6/comm |oad=notaffected,brms-6/comm |ons-fileupload=notaffected, |ons-fileupload=notaffected, |jdv-6/commons-fileupload=no |jdv-6/commons-fileupload=no |taffected,fsw-6/commons-fil |taffected,fsw-6/commons-fil |eupload=notaffected,fuse-6/ |eupload=notaffected,fuse-6/ |commons-fileupload=notaffec |commons-fileupload=notaffec |ted,jon-3/commons-fileuploa |ted,jon-3/commons-fileuploa |d=notaffected,jpp-6/commons |d=notaffected,jpp-6/commons |-fileupload=notaffected,ope |-fileupload=notaffected,ope |nshift-enterprise-2/commons |nshift-enterprise-2/commons |-fileupload=notaffected |-fileupload=notaffected,eap | |-5/jbossas=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0420,reported=20160420,sour |0420,reported=20160420,sour |ce=internet,cvss2=6.8/AV:N/ |ce=internet,cvss2=6.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:P,cvss3 |AC:M/Au:N/C:P/I:P/A:P,cvss3 |=7.3/CVSS:3.0/AV:N/AC:L/PR: |=7.3/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:L,cwe= |N/UI:N/S:U/C:L/I:L/A:L,cwe= |CWE-502,fedora-all/apache-c |CWE-502,fedora-all/apache-c |ommons-fileupload=notaffect |ommons-fileupload=notaffect |ed,epel-7/apache-commons-fi |ed,epel-7/apache-commons-fi |leupload=notaffected,fedora |leupload=notaffected,fedora |-all/tomcat=notaffected,rhe |-all/tomcat=notaffected,rhe |l-7/tomcat=notaffected,rhsc |l-7/tomcat=notaffected,rhsc |l-2.3/rh-thermostat16-apach |l-2.3/rh-thermostat16-apach |e-commons-fileupload=notaff |e-commons-fileupload=notaff |ected,amq-6/commons-fileupl |ected,amq-6/commons-fileupl |oad=notaffected,brms-6/comm |oad=notaffected,brms-6/comm |ons-fileupload=notaffected, |ons-fileupload=notaffected, |jdv-6/commons-fileupload=no |jdv-6/commons-fileupload=no |taffected,fsw-6/commons-fil |taffected,fsw-6/commons-fil |eupload=notaffected,fuse-6/ |eupload=notaffected,fuse-6/ |commons-fileupload=notaffec |commons-fileupload=notaffec |ted,jon-3/commons-fileuploa |ted,jon-3/commons-fileuploa |d=notaffected,jpp-6/commons |d=notaffected,jpp-6/commons |-fileupload=notaffected,ope |-fileupload=notaffected,ope |nshift-enterprise-2/commons |nshift-enterprise-2/commons |-fileupload=notaffected,eap |-fileupload=notaffected,eap |-5/jbossas=notaffected |-5/jbossas=notaffected,jon- | |3/Core | |Server=wontfix/cvss2=6.5/AV | |:N/AC:L/Au:S/C:P/I:P/A:P/cv | |ss3=9.1/CVSS:3.0/AV:N/AC:L/ | |PR:H/UI:N/S:C/C:H/I:H/A:H
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
--- Comment #5 from Jason Shepherd jshepherd@redhat.com --- We agree with Apache's assessment that this does not represent a valid vulnerability in the Commons File Upload library. We have previously written about Java deserialization flaws in a Security Blog post, and encourage anyone interested in this flaw to read more our stance here:
https://access.redhat.com/blogs/766093/posts/2361811
We encourage customers developing applications in Java to assess their use of Java serialization, to ensure they add authentication, and authorization to endpoints which accept data for deserialization. If that application accepts untrusted data for deserialization, and the Commons File Upload library is available on the classpath, it could be exposed to this issue. We consider the vulnerability to be with deseriazliation of untrusted data.
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0420,reported=20160420,sour |0420,reported=20160420,sour |ce=internet,cvss2=6.8/AV:N/ |ce=internet,cvss2=6.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:P,cvss3 |AC:M/Au:N/C:P/I:P/A:P,cvss3 |=7.3/CVSS:3.0/AV:N/AC:L/PR: |=7.3/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:L,cwe= |N/UI:N/S:U/C:L/I:L/A:L,cwe= |CWE-502,fedora-all/apache-c |CWE-502,fedora-all/apache-c |ommons-fileupload=notaffect |ommons-fileupload=notaffect |ed,epel-7/apache-commons-fi |ed,epel-7/apache-commons-fi |leupload=notaffected,fedora |leupload=notaffected,fedora |-all/tomcat=notaffected,rhe |-all/tomcat=notaffected,rhe |l-7/tomcat=notaffected,rhsc |l-7/tomcat=notaffected,rhsc |l-2.3/rh-thermostat16-apach |l-2.3/rh-thermostat16-apach |e-commons-fileupload=notaff |e-commons-fileupload=notaff |ected,amq-6/commons-fileupl |ected,amq-6/commons-fileupl |oad=notaffected,brms-6/comm |oad=notaffected,brms-6/comm |ons-fileupload=notaffected, |ons-fileupload=notaffected, |jdv-6/commons-fileupload=no |jdv-6/commons-fileupload=no |taffected,fsw-6/commons-fil |taffected,fsw-6/commons-fil |eupload=notaffected,fuse-6/ |eupload=notaffected,fuse-6/ |commons-fileupload=notaffec |commons-fileupload=notaffec |ted,jon-3/commons-fileuploa |ted,jon-3/commons-fileuploa |d=notaffected,jpp-6/commons |d=notaffected,jpp-6/commons |-fileupload=notaffected,ope |-fileupload=notaffected,ope |nshift-enterprise-2/commons |nshift-enterprise-2/commons |-fileupload=notaffected,eap |-fileupload=notaffected,eap |-5/jbossas=notaffected,jon- |-5/jbossas=notaffected,jon- |3/Core |3/Core |Server=wontfix/cvss2=6.5/AV |Server=notaffected/cvss2=6. |:N/AC:L/Au:S/C:P/I:P/A:P/cv |5/AV:N/AC:L/Au:S/C:P/I:P/A: |ss3=9.1/CVSS:3.0/AV:N/AC:L/ |P/cvss3=9.1/CVSS:3.0/AV:N/A |PR:H/UI:N/S:C/C:H/I:H/A:H |C:L/PR:H/UI:N/S:C/C:H/I:H/A | |:H
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0420,reported=20160420,sour |0420,reported=20160420,sour |ce=internet,cvss2=6.8/AV:N/ |ce=internet,cvss2=6.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:P,cvss3 |AC:M/Au:N/C:P/I:P/A:P,cvss3 |=7.3/CVSS:3.0/AV:N/AC:L/PR: |=7.3/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:L,cwe= |N/UI:N/S:U/C:L/I:L/A:L,cwe= |CWE-502,fedora-all/apache-c |CWE-502,fedora-all/apache-c |ommons-fileupload=notaffect |ommons-fileupload=notaffect |ed,epel-7/apache-commons-fi |ed,epel-7/apache-commons-fi |leupload=notaffected,fedora |leupload=notaffected,fedora |-all/tomcat=notaffected,rhe |-all/tomcat=notaffected,rhe |l-7/tomcat=notaffected,rhsc |l-7/tomcat=notaffected,rhsc |l-2.3/rh-thermostat16-apach |l-2.3/rh-thermostat16-apach |e-commons-fileupload=notaff |e-commons-fileupload=notaff |ected,amq-6/commons-fileupl |ected,amq-6/commons-fileupl |oad=notaffected,brms-6/comm |oad=notaffected,brms-6/comm |ons-fileupload=notaffected, |ons-fileupload=notaffected, |jdv-6/commons-fileupload=no |jdv-6/commons-fileupload=no |taffected,fsw-6/commons-fil |taffected,fsw-6/commons-fil |eupload=notaffected,fuse-6/ |eupload=notaffected,fuse-6/ |commons-fileupload=notaffec |commons-fileupload=notaffec |ted,jon-3/commons-fileuploa |ted,jon-3/commons-fileuploa |d=notaffected,jpp-6/commons |d=notaffected,jpp-6/commons |-fileupload=notaffected,ope |-fileupload=notaffected,ope |nshift-enterprise-2/commons |nshift-enterprise-2/commons |-fileupload=notaffected,eap |-fileupload=notaffected,eap |-5/jbossas=notaffected,jon- |-5/jbossas=notaffected |3/Core | |Server=notaffected/cvss2=6. | |5/AV:N/AC:L/Au:S/C:P/I:P/A: | |P/cvss3=9.1/CVSS:3.0/AV:N/A | |C:L/PR:H/UI:N/S:C/C:H/I:H/A | |:H |
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0420,reported=20160420,sour |0420,reported=20160420,sour |ce=internet,cvss2=6.8/AV:N/ |ce=internet,cvss2=6.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:P,cvss3 |AC:M/Au:N/C:P/I:P/A:P,cvss3 |=7.3/CVSS:3.0/AV:N/AC:L/PR: |=7.3/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:L,cwe= |N/UI:N/S:U/C:L/I:L/A:L,cwe= |CWE-502,fedora-all/apache-c |CWE-502,fedora-all/apache-c |ommons-fileupload=notaffect |ommons-fileupload=notaffect |ed,epel-7/apache-commons-fi |ed,epel-7/apache-commons-fi |leupload=notaffected,fedora |leupload=notaffected,fedora |-all/tomcat=notaffected,rhe |-all/tomcat=notaffected,rhe |l-7/tomcat=notaffected,rhsc |l-7/tomcat=notaffected,rhsc |l-2.3/rh-thermostat16-apach |l-2.3/rh-thermostat16-apach |e-commons-fileupload=notaff |e-commons-fileupload=notaff |ected,amq-6/commons-fileupl |ected,amq-6/commons-fileupl |oad=notaffected,brms-6/comm |oad=notaffected,brms-6/comm |ons-fileupload=notaffected, |ons-fileupload=notaffected, |jdv-6/commons-fileupload=no |jdv-6/commons-fileupload=no |taffected,fsw-6/commons-fil |taffected,fsw-6/commons-fil |eupload=notaffected,fuse-6/ |eupload=notaffected,fuse-6/ |commons-fileupload=notaffec |commons-fileupload=notaffec |ted,jon-3/commons-fileuploa |ted,jon-3/commons-fileuploa |d=notaffected,jpp-6/commons |d=notaffected,jpp-6/commons |-fileupload=notaffected,ope |-fileupload=notaffected,ope |nshift-enterprise-2/commons |nshift-enterprise-2/commons |-fileupload=notaffected,eap |-fileupload=notaffected,eap |-5/jbossas=notaffected |-5/jbossas=notaffected,jon- | |3/Core Server=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1393454
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com -
Red Hat Bugzilla