--------------------------------------------------------------------------------------------------------------- EGI BROADCAST TOOL : https://operations-portal.egi.eu/broadcast/send --------------------------------------------------------------------------------------------------------------- Publication from : linda cornwall Linda.cornwall@stfc.ac.uk ----------------------------------------------------------------------------------------------------------------

This is the first alert sent by SVG to the VO managers (VM image endorsers) and VO security contacts via the broadcast tool.

Affected software and risk ==========================

Vulnerabilities have been reported concerning Tomcat remote execution in non-standard configurations.

Package : Tomcat CVE ID : CVE-2017-12615, CVE-2017-12617

Remote execution vulnerabilities have been reported concerning Tomcat, however in most configurations they are unlikely to be exploitable. [R 1] [R 2] [R 3] [R 4]

If any site or Virtual Appliance (VM image) endorser is aware that any of these or other tomcat vulnerabilities presents a serious problem to EGI, please inform the EGI SVG.

This alert is being sent to the VO managers and VO security contacts via the EGI broadcast tool, as well as the usual contacts.

Actions required/recommended ============================

For Grid sites, no action is necessary.

There is the possibility that for some FedCloud applications/Virtual Machines (VMs) using Tomcat, that insecure configurations may exist, although SVG is not aware of any. If any site or Virtual Appliance (VM image) endorser is aware that any of these or other tomcat vulnerabilities presents a serious problem to EGI, please inform the EGI SVG.

Affected software details =========================

Various versions of tomcat are vulnerable - See [R 3] - [R 9]

More information ================

If "readonly" is set to 'TRUE' which is the default in RedHat, these vulnerabilities are not exploitable. EGI Grid Middleware using tomcat has been checked by SVG members, and no exploitable usage of tomcat has been found.

It is possible that exploitable configurations exist in the EGI Federated Cloud.

Anyone developing FedCloud Virtual Appliances (VM images) which use tomcat should check that they are not vulnerable and if they are take appropriate action and inform EGI SVG.

2017-11-03 Additional references concerning Scientific Linux and CentOS added [R 11] - [R 14]

Component installation information ==================================

See [R 3] - [R 9]

TLP and URL ===========

** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions***

URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-CVE-2017-12615

Minor updates may be made without re-distribution to the sites

Comments ========

Comments or questions should be sent to svg-rat at mailman.egi.eu

If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to

report-vulnerability at egi.eu

the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 10]

References ==========

[R 1] https://nvd.nist.gov/vuln/detail/CVE-2017-12615

[R 2] https://nvd.nist.gov/vuln/detail/CVE-2017-12617

[R 3] https://access.redhat.com/security/cve/CVE-2017-12615

[R 4] https://access.redhat.com/security/cve/CVE-2017-12617

[R 5] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12615.html

[R 6] http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-12617.html%3E

[R 7] https://security-tracker.debian.org/tracker/CVE-2017-12615

[R 8] https://security-tracker.debian.org/tracker/CVE-2017-12617

[R 9] https://www.scientificlinux.org/

[R 10] https://documents.egi.eu/public/ShowDocument?docid=2538

More references added 2017-11-03

Scientific Linux:--

[R 11] https://www.scientificlinux.org/category/sl-errata/slsa-20173080-1/

[R 12] https://www.scientificlinux.org/category/sl-errata/slsa-20173081-1/

CentOS:--

[R 13] https://lists.centos.org/pipermail/centos-announce/2017-October/022610.html

[R 14] https://lists.centos.org/pipermail/centos-announce/2017-October/022611.html

Credit ======

SVG was alerted to this vulnerability by Vincent Brillault.

Timeline ======== Yyyy-mm-dd [EGI-SVG-2017-CVE-2017-12615]

2017-10-30 SVG alerted to this issue by Vincent Brillault 2017-10-30 Acknowledgement from the EGI SVG to the reporter 2017-10-30 Investigation established grid sites unlikely to be affected 2017-10-30 Discussion took place, decided an alert is appropriate response, as some cloud applications may be affected. 2017-11-02 Alert sent to sites 2017-11-03 Alert sent to VO managers, VO security contacts.

Context =======

This advisory has been prepared as part of the effort to fulfill EGI SVG's purpose "To minimize the risk to the EGI infrastructure arising from software vulnerabilities"

The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R 10] in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending on how the software is used.

Others may re-use this information provided they:-

1) Respect the provided TLP classification

2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group

On behalf of the EGI SVG,

---------------------------------------------------------------------------------------------------------------- link to this broadcast : https://operations-portal.egi.eu/broadcast/archive/1845 ----------------------------------------------------------------------------------------------------------------