Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 11 Feb 2018 09:59:05 +0100
From: Philippe Mouawad <pmouawad@...che.org>
To: JMeter Users List <user@...ter.apache.org>, dev@...ter.apache.org, announce@...che.org, 
	asf-security <security@...che.org>, oss-security@...ts.openwall.com, 
	Brenden Meeder <fishing.for.jormungandr@...il.com>
Subject: CVE-2018-1297: Apache JMeter uses an unsecure RMI connection in
 Distributed mode

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: JMeter 2.X, 3.X

Description [0]:

When using Distributed Test only (RMI based), jmeter uses an unsecured RMI
connection.
This could allow an attacker to get Access to JMeterEngine and send
unauthorized code.
This only affect tests running in Distributed mode.

Mitigation:
  * Users must use last version of Java 8 or Java 9
  * Users must upgrade to last JMeter 4.0 version and use the default /
enabled authenticated SSL RMI connection.

Besides, we remind users that in distributed mode, JMeter makes an
Architectural assumption
that it is operating on a 'safe' network. i.e. everyone with access to the
network is considered trusted.

This typically means a dedicated VPN or similar is being used.


Example:
  * Start JMeter server using either jmeter-server or jmeter -s
  * If JMeter listens on unsecure rmi connection (ie you can connect to it
using a JMeter client), you are vulnerable

Credit:
This issue was reported responsibly to the Apache Tomcat Security Team
by Brenden Meeder.

- Philippe Mouawad

on behalf of the Apache JMeter PMC

[0] https://bz.apache.org/bugzilla/show_bug.cgi?id=62039

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.