oss-security - [CVE-2019-17561] "Apache NetBeans" autoupdate system does not fully validate code signatures.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 29 Mar 2020 22:56:10 +0200
From: Matthias Bläsing <mblaesing@...pel-helix.eu>
To: dev@...beans.apache.org, oss-security@...ts.openwall.com, 
	security@...che.org
Subject: [CVE-2019-17561] "Apache NetBeans" autoupdate system does not fully
 validate code signatures.

CVE-ID
------
CVE-2019-17561

Summary
-------
The "Apache NetBeans" autoupdate system does not fully validate
code signatures.

Versions Affected: 
------------------
- All Apache NetBeans versions up to and including 11.2
- NetBeans releases before the Apache transition started may be
  also affected

Description:
------------
The "Apache NetBeans" autoupdate system does not fully validate
code signatures. An attacker could modify the downloaded nbm and
include additional code.

Mitigation:
-----------
- Disable autoupdates
- Install only plugins from trusted sources and validate the
  downloads by checking signatures and/or comparing checksums
  from trusted sources
- Update to NetBeans 11.3 by downloading the release, verifying the
  signature and manually installing it

Credit:
-------
The investigation was triggered by a proof-of-concept submitted by
Emilian Bold

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.