Date: Sun, 11 Feb 2018 09:59:35 +0100 From: Philippe Mouawad <pmouawad@...che.org> To: JMeter Users List <user@...ter.apache.org>, dev@...ter.apache.org, announce@...che.org, asf-security <security@...che.org>, oss-security@...ts.openwall.com, Brenden Meeder <fishing.for.jormungandr@...il.com> Subject: CVE-2018-1287: Apache JMeter binds RMI server to wildcard in distributed mode (based on RMI) Severity: Important Vendor: The Apache Software Foundation Versions Affected: JMeter 2.X, 3.X Description: When using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. This only affect tests running in Distributed mode. Mitigation: * Users must use last version of Java 8 or Java 9 * Users must upgrade to last JMeter 4.0 version Besides, we remind users that in distributed mode, JMeter makes an Architectural assumption that it is operating on a 'safe' network. i.e. everyone with access to the network is considered trusted. This typically means a dedicated VPN or similar is being used. Example: * Start JMeter server using either jmeter-server or jmeter -s * If JMeter listens on *:1099, you are vulnerable Credit: This issue was reported responsibly to the Apache Tomcat Security Team by Brenden Meeder. - Philippe Mouawad on behalf of the Apache JMeter PMC  https://bz.apache.org/bugzilla/show_bug.cgi?id=62039
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ