Date: Tue, 26 Jul 2016 11:21:31 +1000
From: David Black <dblack@...assian.com>
To: bugtraq@...urityfocus.com
Subject: July 2016 - Bamboo Server - Critical Security Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Note: the current version of this advisory can be found at
https://confluence.atlassian.com/x/rSGSMQ .

CVE ID:
* CVE-2016-5229 - Deserialisation in Bamboo.

Product: Bamboo

Affected Bamboo product versions:
2.3.1 <= version < 5.11.4.1
5.12.0 <= version < 5.12.3.1

Fixed Bamboo product versions:
* for 5.11.x, Bamboo 5.11.4.1 has been released with a fix for this issue.
* for 5.12.x, Bamboo 5.12.3.1 has been released with a fix for this issue.


Summary:
This advisory discloses a critical severity security vulnerability
which was introduced in version 2.3.1 of Bamboo. Versions of Bamboo
starting with 2.3.1 before 5.11.4.1 (the fixed version for 5.11.x) and
from 5.12.0 before 5.12.3.1 (the fixed version for 5.12.x) are
affected by this vulnerability.

Atlassian Cloud instances have already been upgraded to a version of
Bamboo which does not have the issue described in this advisory.

Customers who have upgraded Bamboo to version 5.11.4.1 or version
5.12.3.1 are not affected.

Customers who have downloaded and installed Bamboo >= 2.3.1 less than
5.11.4.1 (the fixed version for 5.11.x) and Customers who have
downloaded and installed Bamboo >= 5.12.0 less than 5.12.3.1 (the
fixed version for 5.12.x) please upgrade your Bamboo installations
immediately to fix this vulnerability.


Acknowledgements:
We would like to credit Moritz Bechler of AgNO3 for reporting this issue to us.


Deserialisation resulting in remote code execution caused by
insufficient restriction on permitted deserialised classes
(CVE-2016-5229)
Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels. The
scale allows us to rank the severity as critical, high, moderate or
low.
This is an independent assessment and you should evaluate its
applicability to your own IT environment.


Description:

Bamboo had a resource that deserialised input from build agents and
did not sufficiently restrict which classes could be deserialised. To
exploit this issue, attackers need to have a valid Bamboo agent
fingerprint or be able to run code on a Bamboo agent.

All versions of Bamboo from 2.3.1 before 5.11.4.1 (the fixed version
for 5.11.x) and from 5.12.0 before 5.12.3.1 (the fixed version for
5.12.x) are affected by this vulnerability. This issue can be tracked
here: https://jira.atlassian.com/browse/BAM-17736


Mitigation:

This issue can be mitigated in Bamboo version 5.10.0 and higher by
setting the XStream Serialization setting to "whitelist" which prior
to the fix versions detailed in this advisory was not the default. See
the Serialization protection methods page
(https://confluence.atlassian.com/x/gJOzLw) for information on
serialization settings.


Fix:

We have taken the follow steps to address this issue:
* Released Bamboo version 5.12.3.1 that contains fixes for this issue.
* Released Bamboo version 5.11.4.1 that contains fixes for this issue.


Remediation:
Upgrade Bamboo to version 5.12.3.1 or higher.

If you are running Bamboo 5.11.x and cannot upgrade to bamboo 5.12.3.1
then upgrade to version 5.11.4.1.


If you are running Bamboo 5.10.x or higher and cannot upgrade to
5.11.4.1 or 5.12.3.1 then you can follow following steps to mitigate
the issue:
1. Log in to Bamboo as an administrator and go to Bamboo
administration > Security > Security settings which is found at
/admin/configureSecurity.action for your Bamboo instance, for example
http://bamboo-host/bamboo/admin/configureSecurity.action
2. Under the Serialization protection methods section, set the XStream
setting to Whitelist.
3. Click Save.
4. Check that XStream is set to Whitelist after reloading the Security
Settings page.

See the Serialization protection methods page
(https://confluence.atlassian.com/x/gJOzLw) for information on
serialization settings.

For a full description of the latest version of Bamboo, see the
release notes found at
https://confluence.atlassian.com/display/BAMBOO/Bamboo+releases.

You can download the latest version of Bamboo from the download centre
found at https://www.atlassian.com/software/bamboo/download.

Support:
If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/ .


- --
David Black / Security Engineer.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJXlrO3AAoJECQgl6K8UnaguiMP/Rri5vOtUQ4V/QC6uCBndguP
e9FAUKoQ/sQEF4OkoprtW7/ZbA/vfJKg2/+8ZWvwe2OySUdUBF6SjlaOhiWSZYmh
5n0JDutXCWHyW1luvMvFghRlZQWBQPbckfyN3AKAnIoMtPn7yqJOtsY/LfTg7msj
zcTttcR9tEV0icUqEC666POfxVLdbG0EMThUMU8ddXDaavc5/us/gRya0/WOEWzL
ZnWz+zcw0iA40jGcqwpgj858+4BRPK/O4rsGJn9RGlvHGUFs6OJflZaslTks2292
hlPHSnJZhxMkCN+jBlAsM1BXXbfW7WlKINucJflDKNcbSXJUIf8cjSbz9JvjqlPa
g77tj94Lkx9yuszT9MlwNRXWzSIxn3XyuupSBwtJ8NsYULP3IP9RXBYUfa3p0WHn
z+Cxi0ho+ZKssbJQI7lr+kDZQILpO+r7wbKrvh+6FBRFv9T4pDPBAvsD4bb853NR
GuUc9YWSwu8BRIoR+6rXK3Wl3Ndh6E4m3HH/oNI4CuH+osZk53maVpgtTU9ZcgcX
77ZtMBdVB1tGD6e63JKlMKQMpMoVWHuvEAt3uYThJekT5J1n2cup22q4BLIHxjYQ
uEk8argt1EGNiFOl4hP/lIKEoVItkP9BpT09BSemvrLRqCgMXHxGn9xnRym6hoyv
5BuA6SIa5i0PgeLWzgxS
=lu9n
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists