[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAF1aazCpJPNS42M5+8gAmyBQbcMBFcRe4g_e7O6U+rG8SjM6LA@mail.gmail.com>
Date: Mon, 30 Mar 2015 16:11:33 -0400
From: Dave <snoopdave@...il.com>
To: security@...che.org, oss-security@...ts.openwall.com,
bugtraq@...urityfocus.com
Subject: Fwd: CVE-2015-0249: Apache Roller allows admin users to execute
arbitrary Java code
---------- Forwarded message ----------
From: Dave <snoopdave@...il.com>
Date: Tue, Mar 24, 2015 at 7:22 PM
Subject: CVE-2015-0249: Apache Roller allows admin users to execute
arbitrary Java code
To: "dev@...ler.apache.org" <dev@...ler.apache.org>, user@...ler.apache.org
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Roller 5.1.1
Roller 5.1
The unsupported pre-Roller 5.1 versions may also be affected
Description:
A Roller user with Admin-level access to a weblog can edit a weblog
page template and use special Velocity syntax to execute Java code on
the server.
Mitigation:
There are several ways you can fix this vulnerability:
1) Upgrade to the latest version of Roller, which is now 5.1.2.
2) Or, add the following line to Roller's velocity.properties file:
runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector
3) Or, disable template editing on your Roller system by un-checking
the Allow Custom Themes setting in the Server Admin -> Configuration
page,
Theme Settings section.
Credit:
This issue was discovered by Gregory Draperi.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
