[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 05 Sep 2013 13:35:23 +1000
From: David Jorm <djorm@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2013-2185 / Tomcat
On 09/05/2013 12:11 AM, Moritz Muehlenhoff wrote:
> Hi,
> Question to the Red Hat people on the list:
>
> Is https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2185 something which applies
> to Tomcat in general or is this specific to the "Red Hat JBoss Enterprise
> Application Platform"?
>
> The DiskFileItem class is part of Tomcat 7, but there's no reference to CVE-2013-2185
> at http://tomcat.apache.org/security-7.html
>
> Cheers,
> Moritz
Hi Moritz
This flaw was reported to the tomcat security team, but they were of the
opinion that it did not constitute a security flaw in tomcat. The Red
Hat security team decided that we did consider it a security flaw in
tomcat, and handled it accordingly. I think whether or not this category
of issue is considered a security flaw is an unresolved debate - having
some consensus either way would be helpful in my opinion.
The DiskFileItem class's readObject method contained a poison null byte
flaw. A remote attacker able to supply a serialized instance of the
DiskFileItem class, which will be deserialized on a server, could use
this flaw to write arbitrary content to any location on the server that
is permitted by the user running the application server process. The key
point here is that an application is only vulnerable if it deserializes
arbitrary user-supplied data, and it has DiskFileItem on the classpath.
One argument is that since exploitation relies on an application
allowing deserialization of user-supplied data, the real flaw lies in
that application, so this is not actually a security flaw in
DiskFileItem. The opposing argument is that an application allowing
deserialization of user-supplied data would not necessarily expose any
kind of security flaw, but if a vulnerable class (e.g. DiskFileItem)
existed on the server's classpath, then it would, therefore this is a
security flaw in DiskFileItem.
Thanks
--
David Jorm / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
