SB2018021303 - Security restrictions bypass in Apache JMeter
Published: February 13, 2018
Security Bulletin ID
SB2018021303
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2018-1287)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to the binding of RMI Registry to wildcard host when using Distributed Test only (RMI based). A remote attacker can escape the sandbox, gain access to JMeterEngine and send an unauthorized code.
2) Security restrictions bypass (CVE-ID: CVE-2018-1297)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to the use of an unsecured RMI connection. A remote attacker can escape the sandbox, gain access to JMeterEngine and send unauthorized code.
Remediation
Install update from vendor's website.