Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 30 Mar 2015 16:11:33 -0400
From: Dave <snoopdave@...il.com>
To: security@...che.org, oss-security@...ts.openwall.com, 
	bugtraq@...urityfocus.com
Subject: Fwd: CVE-2015-0249: Apache Roller allows admin users to execute
 arbitrary Java code

---------- Forwarded message ----------
From: Dave <snoopdave@...il.com>
Date: Tue, Mar 24, 2015 at 7:22 PM
Subject: CVE-2015-0249: Apache Roller allows admin users to execute
arbitrary Java code
To: "dev@...ler.apache.org" <dev@...ler.apache.org>, user@...ler.apache.org


Severity: Important

Vendor:
   The Apache Software Foundation

Versions Affected:
   Roller 5.1.1
   Roller 5.1
   The unsupported pre-Roller 5.1 versions may also be affected

Description:

   A Roller user with Admin-level access to a weblog can edit a weblog
   page template and use special Velocity syntax to execute Java code on
   the server.

Mitigation:

   There are several ways you can fix this vulnerability:

   1) Upgrade to the latest version of Roller, which is now 5.1.2.

   2) Or, add the following line to Roller's velocity.properties file:


runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector

   3) Or, disable template editing on your Roller system by un-checking
      the Allow Custom Themes setting in the Server Admin -> Configuration
page,
      Theme Settings section.

Credit:

   This issue was discovered by Gregory Draperi.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.