bugtraq - [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 16 Jul 2015 12:04:44 +0200
From: Cédric Champeau <cedric.champeau@...il.com>
To: bugtraq@...urityfocus.com
Subject: [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:

All unsupported versions ranging from 1.7.0 to 2.4.3.

Impact

Remote execution of untrusted code, DoS

Description

When an application has Groovy on classpath and that it uses standard
Java serialization mechanims to communicate between servers, or to
store local data, it is possible for an attacker to bake a special
serialized object that will execute code directly when deserialized.
All applications which rely on serialization and do not isolate the
code which deserializes objects are subject to this vulnerability.

Mitigation

Apache Groovy 2.4.4 is the first and only supported release under the
Apache Software Foundation. It is strongly recommanded that all users
upgrade to this version. If you cannot upgrade or rely on an older,
unsupported version of Groovy, you can apply the following patch on
the MethodClosure class
(src/main/org/codehaus/groovy/runtime/MethodClosure.java):

 public class MethodClosure extends Closure {
+    private Object readResolve() {
+        throw new UnsupportedOperationException();
+    }

Credit

This vulnerability was discovered by:

   cpnrodzc7 working with HP's Zero Day Initiative

References

http://groovy-lang.org/security.html