IBM Support

Security Bulletin: ClassLoader manipulation with Apache Struts affecting Rational Application Developer (CVE-2014-0114)

Security Bulletin


Summary

There is a ClassLoader manipulation vulnerability in Apache Struts that is bundled by IBM Rational Application Developer for WebSphere Software.

Vulnerability Details

 Subscribe to My Notifications to be notified of important product support alerts like this.
  • Follow this link for more information (requires login with your IBM ID)

CVEID: CVE-2014-0114


Description: Apache Struts 1.X could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. There is partial impact to confidentiality, integrity, and availability.

CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/92889 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Rational Application Developer 7.0 to 9.1 are affected.

Remediation/Fixes

The issue can be addressed by installing a servlet filter to prevent passing an attack payload to the action servlet of your struts applications.

ProductVRMFAPARRemediation/First Fix
Rational Application Developer7.0 through to 9.1PI18782
  1. Download CVE-2014-0114_patch.jar
  2. Add a copy of the JAR file to the WEB-INF/lib/ folder of your Web module.
  3. Modify your Web modules' deployment descriptor to ensure parameters passed to the struts code is filtered:
    1. Open the Web module deployment descriptor (web.xml)
    2. Add a new filter
      1. Set the filter name to ParamFilter
      2. Set the filter class to com.ibm.rational.struts1x.patch.ParamFilter
    3. Add a new Initialization Parameter to the filter created in step 2.
      1. Set the initialization parameter name to excludeParams
      2. Set the initialization parameter value to the following:

        (.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*
    4. Add a new filter mapping
      1. Set the filter mapping name to ParamFilter
      2. Add a new Servlet Name to the filter mapping
        1. Set the name to be the name of the existing servlet for each Struts action.
    5. Save the descriptor file

The end result will be the following:


<filter>
<filter-name>ParamFilter</filter-name>
<filter-class>com.ibm.rational.struts1x.patch.ParamFilter</filter-class>
<init-param>
<param-name>excludeParams</param-name>
<param-value>(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>ParamFilter</filter-name>
<servlet-name>YOUR ACTION SERVLET</servlet-name>
</filter-mapping>

Note: IBM does not plan on shipping any fix for Struts 1.x as the fix is only available at the current levels of Apache Struts which can only be obtained from the Apache Struts website.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog


Security Bulletin: ClassLoader manipulation with Apache Struts in WebSphere Application Server affecting Rational Application Developer (CVE-2014-0114)

Change History

* 28 May 2014: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

PSIRT Adv 1719, Record 36020

[{"Product":{"code":"SSRTLW","label":"Rational Application Developer for WebSphere Software"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Web Development","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF022","label":"OS X"},{"code":"PF033","label":"Windows"}],"Version":"7.0;7.0.0.1;7.0.0.10;7.0.0.2;7.0.0.3;7.0.0.4;7.0.0.5;7.0.0.6;7.0.0.7;7.0.0.8;7.0.0.9;7.5;7.5.1;7.5.2;7.5.3;7.5.4;7.5.5;7.5.5.1;7.5.5.2;7.5.5.3;7.5.5.4;7.5.5.5;8.0;8.0.1;8.0.2;8.0.3;8.0.4;8.0.4.1;8.0.4.2;8.0.4.3;8.5;8.5.1;8.5.5;9.0;9.0.1;9.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSJVRK","label":"Rational Application Developer Standard Edition for WebSphere Software"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":" ","Platform":[{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}],"Version":"8.0;8.0.1;8.0.2;8.0.3;8.0.4;8.0.4.1;8.0.4.2;8.0.4.3","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
04 February 2020

UID

swg21674310

Page Feedback