oss-security - RE: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 5 Jun 2018 17:11:11 +0000
From: "Rai, Harendra" <Harendra.Rai@....com>
To: Denis Magda <dmagda@...che.org>,
        "announce@...che.org"
	<announce@...che.org>,
        dev <dev@...ite.apache.org>,
        "user@...ite.apache.org"
	<user@...ite.apache.org>,
        "oss-security@...ts.openwall.com"
	<oss-security@...ts.openwall.com>
Subject: RE: [CVE-2014-0114]: Apache Ignite is vulnerable to existing
 CVE-2014-0114

I found other security issues and I have created a bug. https://issues.apache.org/jira/browse/IGNITE-8713

Harendra Rai
Software Engineer
NCR Corporation
office: 770.495.2864
mobile: 248.787.2876
harendra.rai@....com<mailto:harendra.rai@....com>
www.ncr.com<http://www.ncr.com>
[cid:image003.png@...0405E.86F4AD70]

From: Denis Magda [mailto:dmagda@...che.org]
Sent: Friday, June 01, 2018 1:17 PM
To: announce@...che.org; dev <dev@...ite.apache.org>; user@...ite.apache.org; oss-security@...ts.openwall.com; Rai, Harendra <Harendra.Rai@....com>
Subject: [CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114

[CVE-2014-0114]: Apache Ignite is vulnerable to existing CVE-2014-0114

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Ignite 2.4 or earlier

Impact:
An attacker can execute arbitrary code on Ignite nodes in the case when Ignite classpath contains arbitrary vulnerable classes.

Description:
Apache Ignite used commons-beanutils-1.8.3.jar library which did not suppress the class property, which allowed remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Mitigation:
•    All Ignite versions: make sure there are no vulnerable classes among your custom code used in Apache Ignite.
•    Upgrade to Apache Ignite 2.5 or later version

Credit:
Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite.

References:
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114<https://urldefense.proofpoint.com/v2/url?u=https-3A__cve.mitre.org_cgi-2Dbin_cvename.cgi-3Fname-3DCVE-2D2014-2D0114&d=DwMFaQ&c=gJN2jf8AyP5Q6Np0yWY19w&r=9MqLDuI-YOHfnUsZj8zKAiE5cb4pd-EqZwfbefzAn18&m=O7V5T4VKtGxA1W7Dnp3dZmxv7FT2fy722704x0eAntk&s=shK2q4cumx70o8xqWHBcY19R-DVSgNIy32P-zTTbJNo&e=>

Content of type "text/html" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.