Date: Thu, 05 Sep 2013 13:35:23 +1000 From: David Jorm <djorm@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2013-2185 / Tomcat On 09/05/2013 12:11 AM, Moritz Muehlenhoff wrote: > Hi, > Question to the Red Hat people on the list: > > Is https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2185 something which applies > to Tomcat in general or is this specific to the "Red Hat JBoss Enterprise > Application Platform"? > > The DiskFileItem class is part of Tomcat 7, but there's no reference to CVE-2013-2185 > at http://tomcat.apache.org/security-7.html > > Cheers, > Moritz Hi Moritz This flaw was reported to the tomcat security team, but they were of the opinion that it did not constitute a security flaw in tomcat. The Red Hat security team decided that we did consider it a security flaw in tomcat, and handled it accordingly. I think whether or not this category of issue is considered a security flaw is an unresolved debate - having some consensus either way would be helpful in my opinion. The DiskFileItem class's readObject method contained a poison null byte flaw. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is permitted by the user running the application server process. The key point here is that an application is only vulnerable if it deserializes arbitrary user-supplied data, and it has DiskFileItem on the classpath. One argument is that since exploitation relies on an application allowing deserialization of user-supplied data, the real flaw lies in that application, so this is not actually a security flaw in DiskFileItem. The opposing argument is that an application allowing deserialization of user-supplied data would not necessarily expose any kind of security flaw, but if a vulnerable class (e.g. DiskFileItem) existed on the server's classpath, then it would, therefore this is a security flaw in DiskFileItem. Thanks -- David Jorm / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ