Re: CVE-2013-2185 / Tomcat

[David Jorm <djorm () redhat com>]

On 09/05/2013 12:11 AM, Moritz Muehlenhoff wrote:
> Hi,
> Question to the Red Hat people on the list:
>
> Is https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2185 something which applies
> to Tomcat in general or is this specific to the  "Red Hat JBoss Enterprise
> Application Platform"?
>
> The DiskFileItem class is part of Tomcat 7, but there's no reference to CVE-2013-2185
> at http://tomcat.apache.org/security-7.html
>
> Cheers,
>          Moritz

Hi Moritz

This flaw was reported to the tomcat security team, but they were of the 
opinion that it did not constitute a security flaw in tomcat. The Red 
Hat security team decided that we did consider it a security flaw in 
tomcat, and handled it accordingly. I think whether or not this category 
of issue is considered a security flaw is an unresolved debate - having 
some consensus either way would be helpful in my opinion.

The DiskFileItem class's readObject method contained a poison null byte 
flaw. A remote attacker able to supply a serialized instance of the 
DiskFileItem class, which will be deserialized on a server, could use 
this flaw to write arbitrary content to any location on the server that 
is permitted by the user running the application server process. The key 
point here is that an application is only vulnerable if it deserializes 
arbitrary user-supplied data, and it has DiskFileItem on the classpath. 
One argument is that since exploitation relies on an application 
allowing deserialization of user-supplied data, the real flaw lies in 
that application, so this is not actually a security flaw in 
DiskFileItem. The opposing argument is that an application allowing 
deserialization of user-supplied data would not necessarily expose any 
kind of security flaw, but if a vulnerable class (e.g. DiskFileItem) 
existed on the server's classpath, then it would, therefore this is a 
security flaw in DiskFileItem.

Thanks
--
David Jorm / Red Hat Security Response Team