SVG:Advisory-SVG-CVE-2017-12615

Main page

Software Security Checklist

Issue Handling

Advisories

Notes On Risk

Advisory Template

More

---

Advisory-SVG-CVE-2017-12615

Title:       EGI SVG 'ALERT' [TLP:WHITE] Tomcat remote execution 
             in non-standard configurations [EGI-SVG-CVE-2017-12615] 

Date:        2017-11-01
Updated:     

Affected software and risk
==========================

Vulnerabilities have been reported concerning Tomcat remote execution in non-standard configurations.  

Package : Tomcat
CVE ID  : CVE-2017-12615, CVE-2017-12617 

Remote execution vulnerabilities have been reported concerning Tomcat, however in most configurations 
they are unlikely to be exploitable.  [R 1] [R 2] [R 3] [R 4] 

If any site or Virtual Appliance (VM image) endorser is aware that any of these or other tomcat 
vulnerabilities presents a serious problem to EGI, please inform the EGI SVG. 

This alert is being sent to the VO managers and VO security contacts via the EGI broadcast tool, 
as well as the usual contacts.

Actions required/recommended
============================

For Grid sites, no action is necessary.

There is the possibility that for some FedCloud applications/Virtual Machines (VMs) using Tomcat, 
that insecure configurations may exist, although SVG is not aware of any.  
If any site or Virtual Appliance (VM image) endorser is aware that any of these or other tomcat 
vulnerabilities presents a serious problem to EGI, please inform the EGI SVG. 

Affected software details
=========================

Various versions of tomcat are vulnerable - See [R 3] - [R 9]

More information
================

If "readonly" is set to 'TRUE' which is the default in RedHat, these vulnerabilities are not exploitable.  
EGI Grid Middleware using tomcat has been checked by SVG members, and no exploitable usage of tomcat has been found.

It is possible that exploitable configurations exist in the EGI Federated Cloud. 
Anyone developing FedCloud Virtual Appliances (VM images) which use tomcat should check that they are not 
vulnerable and if they are take appropriate action and inform EGI SVG. 


Component installation information
==================================

See [R 3] - [R 9]

TLP and URL
===========

** WHITE information - Unlimited distribution 
  - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions*** 
                      
URL:   https://wiki.egi.eu/wiki/SVG:Advisory-SVG-CVE-2017-12615   

Minor updates may be made without re-distribution to the sites


Comments
========

Comments or questions should be sent to svg-rat  at  mailman.egi.eu

If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to  

report-vulnerability at egi.eu
 
the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 10]  


References
==========


[R 1] https://nvd.nist.gov/vuln/detail/CVE-2017-12615

[R 2] https://nvd.nist.gov/vuln/detail/CVE-2017-12617

[R 3] https://access.redhat.com/security/cve/CVE-2017-12615

[R 4] https://access.redhat.com/security/cve/CVE-2017-12617

[R 5] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12615.html 

[R 6] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12617.html> 

[R 7] https://security-tracker.debian.org/tracker/CVE-2017-12615 

[R 8] https://security-tracker.debian.org/tracker/CVE-2017-12617

[R 9] https://www.scientificlinux.org/

[R 10] https://documents.egi.eu/public/ShowDocument?docid=2538

Credit
======

SVG was alerted to this vulnerability by Vincent Brillault. 

Timeline  
========
Yyyy-mm-dd  [EGI-SVG-2017-CVE-2017-12615] 

2017-10-30 SVG alerted to this issue by Vincent Brillault
2017-10-30 Acknowledgement from the EGI SVG to the reporter
2017-10-30 Investigation established grid sites unlikely to be affected
2017-10-30 Discussion took place, decided an alert is appropriate response, as some cloud applications may be affected.
2017-11-02 Alert sent to sites, VO managers, VO security contacts. 

Context
=======

This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose 
"To minimize the risk to the EGI infrastructure arising from software vulnerabilities"

The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R 10]  
in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, 
we do not guarantee it to be correct. The risk may also be higher or lower in other deployments 
depending on how the software is used.   

Others may re-use this information provided they:-

1) Respect the provided TLP classification

2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group


On behalf of the EGI SVG,