SB2014042909 - Remote code execution in Apache Struts
Published: April 29, 2014 Updated: October 22, 2022
Security Bulletin ID
SB2014042909
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0112)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper access restrictions within the getClass method in ParametersInterceptor. A remote non-authenticated attacker can manipulate the ClassLoader via a specially crafted request and execute arbitrary code on the system.
Note, the vulnerability exists due to incomplete fix for #VU5234 (CVE-2014-0094).
Remediation
Install update from vendor's website.
References
- http://jvn.jp/en/jp/JVN19294237/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- http://secunia.com/advisories/59178
- http://secunia.com/advisories/59500
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.securityfocus.com/archive/1/531952/100/0/threaded
- http://www.securityfocus.com/archive/1/532549/100/0/threaded
- http://www.securityfocus.com/bid/67064
- http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21676706
- https://access.redhat.com/errata/RHSA-2019:0910
- https://bugzilla.redhat.com/show_bug.cgi?id=1091939
- https://cwiki.apache.org/confluence/display/WW/S2-021