The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

Red Hat OpenShift Enterprise release 3.1.1 is now available with updates to packages that fix several security issues, bugs and introduce feature enhancements.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

The following security issues are addressed with this release :

An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to gain additional access to resources such as RAM and disk space. (CVE-2016-1905)

An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain build- configuration strategies. A remote attacker could create build configurations with strategies that violate policy. Although the attacker could not launch the build themselves (launch fails when the policy is violated), if the build configuration files were later launched by other privileged services (such as automated triggers), user privileges could be bypassed allowing attacker escalation.
(CVE-2016-1906)

An update for Jenkins Continuous Integration Server that addresses a large number of security issues including XSS, CSRF, information disclosure and code execution have been addressed as well.
(CVE-2013-2186, CVE-2014-1869, CVE-2014-3661, CVE-2014-3662 CVE-2014-3663, CVE-2014-3664, CVE-2014-3666, CVE-2014-3667 CVE-2014-3680, CVE-2014-3681, CVE-2015-1806, CVE-2015-1807 CVE-2015-1808, CVE-2015-1810, CVE-2015-1812, CVE-2015-1813 CVE-2015-1814, CVE-2015-5317, CVE-2015-5318, CVE-2015-5319 CVE-2015-5320, CVE-2015-5321, CVE-2015-5322, CVE-2015-5323 CVE-2015-5324, CVE-2015-5325, CVE-2015-5326 ,CVE-2015-7537 CVE-2015-7538, CVE-2015-7539, CVE-2015-8103)

Space precludes documenting all of the bug fixes and enhancements in this advisory. See the OpenShift Enterprise 3.1 Release Notes, which will be updated shortly for release 3.1.1, for details about these changes :

https://docs.openshift.com/enterprise/3.1/release_notes/ ose_3_1_release_notes.html

All OpenShift Enterprise 3 users are advised to upgrade to these updated packages.

The version of Oracle WebLogic Portal installed on the remote host is missing a security patch from the January 2016 Critical Patch Update (CPU). It is, therefore, affected by a file upload vulnerability in the bundled Apache Commons library. A flaw exists in the DiskFileItem class that is triggered during the handling of NULL characters. A remote attacker can exploit this, via a serialized instance of the DiskFileItem class, to upload arbitrary files.

The remote host has a version of Oracle WebLogic Server installed that is affected by multiple unspecified vulnerabilities affecting the following components :

  - CIE Related Components
  - WLS-Config
  - WLS-Console

An updated jakarta-commons-fileupload package that fixes one security issue is now available for Red Hat JBoss Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Apache Commons FileUpload component can be used to add a file upload capability to your applications.

A flaw was found in the way the DiskFileItem class handled NULL characters in file names. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process. (CVE-2013-2186)

Warning: Before applying the update, back up your existing Red Hat JBoss Enterprise Web Server installation (including all applications and configuration files).

All users of Red Hat JBoss Web Server 1.0.2 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to this updated package. The JBoss server process must be restarted for the update to take effect.

The remote web server hosts a version of Jenkins (open source) or CloudBees Jenkins Enterprise that is affected by multiple vulnerabilities :

  - An error exists related to file upload processing that     allows a remote attacker to overwrite arbitrary files.
    (CVE-2013-2186)

  - An input validation error exists related to the included     'ZeroClipboard' component that allows cross-site     scripting attacks. (CVE-2014-1869)

  - An error exists related to 'CLI handshake' handling that     allows denial of service attacks. (CVE-2014-3661)

  - An error exists related to handling login attempts using     non-existent or incorrect account names that allows a     remote attacker to enumerate application user names.
    (CVE-2014-3662)

  - An error exists related to handling users having     'Job/CONFIGURE' permissions that allows such users to     perform actions meant only for 'Job/CREATE' permissions.
    (CVE-2014-3663)

  - An error exists related to handling users having     'Overall/READ' permissions that allows directory     traversal attacks. (CVE-2014-3664)

  - An error exists related to the 'CLI channel' that allows     arbitrary code execution by a remote attacker on the     Jenkins master. (CVE-2014-3666)

  - An error exists related to handling users having     'Overall/READ' permissions that allows plugin source     code to be disclosed. (CVE-2014-3667)

  - An input validation error exists related to the     'Monitoring' plugin that allows cross-site scripting     attacks. (CVE-2014-3678)

  - An error exists related to the 'Monitoring' plugin that     allows unauthorized access to sensitive information.
    (CVE-2014-3679)

  - An error exists related to handling users having     'Job/READ' permissions that allows such users to     obtain default passwords belonging to parameterized     jobs. (CVE-2014-3680)

  - An unspecified input validation error allows cross-site     scripting attacks. (CVE-2014-3681)

Jenkins Security Advisory :

Please reference CVE/URL list for details

&#9;A remote attacker could supply a serialized instance of the DiskFileItem class, which would be deserialized on a server and write arbitrary content to any location on the server that is permitted by the user running the application server process.
bnc#846174/CVE-2013-2186

It was discovered that Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications, incorrectly handled file names with NULL bytes in serialized instances. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process.

It was discovered that Apache Commons FileUpload incorrectly handled file names with NULL bytes in serialized instances. An attacker could use this issue to possibly write to arbitrary files.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

jakarta-commons-fileupload received a security fix :

  - A poison null byte flaw was found in the implementation     of the DiskFileItem class. A remote attacker could able     to supply a serialized instance of the DiskFileItem     class, which would be deserialized on a server, could     use this flaw to write arbitrary content to any location     on the server that is permitted by the user running the     application server process. (CVE-2013-2186)

ID	Name	Product	Family	Severity
119442	RHEL 7 : openshift (RHSA-2016:0070)	Nessus	Red Hat Local Security Checks	critical
88086	Oracle WebLogic Portal Apache Commons File Upload (January 2016 CPU)	Nessus	Misc.	high
80909	Oracle WebLogic Server Multiple Vulnerabilities (January 2015 CPU)	Nessus	Misc.	high
78973	RHEL 5 / 6 : JBoss Web Server (RHSA-2013:1428)	Nessus	Red Hat Local Security Checks	high
78859	Jenkins < 1.583 / 1.565.3 and Jenkins Enterprise 1.532.x / 1.554.x / 1.565.x < 1.532.10.1 / 1.554.10.1 / 1.565.3.1 Multiple Vulnerabilities	Nessus	CGI abuses	critical
78017	FreeBSD : jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS (549a2771-49cc-11e4-ae2c-c80aa9043978)	Nessus	FreeBSD Local Security Checks	high
75174	openSUSE Security Update : jakarta-commons-fileupload (openSUSE-SU-2013:1571-1)	Nessus	SuSE Local Security Checks	high
71618	Debian DSA-2827-1 : libcommons-fileupload-java - arbitrary file upload via deserialization	Nessus	Debian Local Security Checks	high
70876	Ubuntu 10.04 LTS : libcommons-fileupload-java vulnerability (USN-2029-1)	Nessus	Ubuntu Local Security Checks	high
70872	SuSE 11.2 / 11.3 Security Update : jakarta-commons-fileupload (SAT Patch Numbers 8445 / 8446)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2013-2186

high

Tenable Plugins

critical

high

high

high

critical

high

high

high

high

high