Title: EGI SVG 'ALERT' [TLP:WHITE] Tomcat remote execution
in non-standard configurations [EGI-SVG-CVE-2017-12615]
Date: 2017-11-01
Updated: 2017-11-03
Affected software and risk
==========================
Vulnerabilities have been reported concerning Tomcat remote execution in
non-standard configurations.
Package : Tomcat
CVE ID : CVE-2017-12615, CVE-2017-12617
Remote execution vulnerabilities have been reported concerning Tomcat, however
in most configurations they are unlikely to be exploitable. [R 1] [R 2] [R 3]
[R 4]
If any site or Virtual Appliance (VM image) endorser is aware that any of these
or other tomcat vulnerabilities presents a serious problem to EGI, please
inform the EGI SVG.
This alert is being sent to the VO managers and VO security contacts via the
EGI broadcast tool, as well as the usual contacts.
Actions required/recommended
============================
For Grid sites, no action is necessary.
There is the possibility that for some FedCloud applications/Virtual Machines
(VMs) using Tomcat, that insecure configurations may exist, although SVG is not
aware of any.
If any site or Virtual Appliance (VM image) endorser is aware that any of these
or other tomcat vulnerabilities presents a serious problem to EGI, please
inform the EGI SVG.
Affected software details
=========================
Various versions of tomcat are vulnerable - See [R 3] - [R 9]
More information
================
If "readonly" is set to 'TRUE' which is the default in RedHat, these
vulnerabilities are not exploitable.
EGI Grid Middleware using tomcat has been checked by SVG members, and no
exploitable usage of tomcat has been found.
It is possible that exploitable configurations exist in the EGI Federated
Cloud.
Anyone developing FedCloud Virtual Appliances (VM images) which use tomcat
should check that they are not vulnerable and if they are take appropriate
action and inform EGI SVG.
2017-11-03 Additional references concerning Scientific Linux and CentOS added
[R 11] - [R 14]
Component installation information
==================================
See [R 3] - [R 9]
TLP and URL
===========
** WHITE information - Unlimited distribution
- see https://go.egi.eu/tlp for distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2017-12615
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 10]
References
==========
[R 1] https://nvd.nist.gov/vuln/detail/CVE-2017-12615
[R 2] https://nvd.nist.gov/vuln/detail/CVE-2017-12617
[R 3] https://access.redhat.com/security/cve/CVE-2017-12615
[R 4] https://access.redhat.com/security/cve/CVE-2017-12617
[R 5] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12615.html
[R 6] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12617.html>
[R 7] https://security-tracker.debian.org/tracker/CVE-2017-12615
[R 8] https://security-tracker.debian.org/tracker/CVE-2017-12617
[R 9] https://www.scientificlinux.org/
[R 10] https://documents.egi.eu/public/ShowDocument?docid=2538
Scientific Linux:--
[R 11] https://www.scientificlinux.org/category/sl-errata/slsa-20173080-1/
[R 12] https://www.scientificlinux.org/category/sl-errata/slsa-20173081-1/
CentOS:--
[R 13] https://lists.centos.org/pipermail/centos-announce/2017-October/022610.html
[R 14] https://lists.centos.org/pipermail/centos-announce/2017-October/022611.html
Credit
======
SVG was alerted to this vulnerability by Vincent Brillault.
Timeline
========
Yyyy-mm-dd [EGI-SVG-2017-CVE-2017-12615]
2017-10-30 SVG alerted to this issue by Vincent Brillault
2017-10-30 Acknowledgement from the EGI SVG to the reporter
2017-10-30 Investigation established grid sites unlikely to be affected
2017-10-30 Discussion took place, decided an alert is appropriate response, as
some cloud applications may be affected.
2017-11-02 Alert sent to sites
2017-11-03 Alert sent to VO managers, VO security contacts.
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 10] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.
Others may re-use this information provided they:-
1) Respect the provided TLP classification
2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group
On behalf of the EGI SVG,