Mailing-List: contact users-help@groovy.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@groovy.incubator.apache.org
MIME-Version: 1.0
Reply-To: cchampeau@apache.org
Date: Thu, 16 Jul 2015 12:02:21 +0200
Message-ID: 
 <CADQzvmmYC7RbZnsQ8O63XN4HCMYh9RGRdMiuWupVt=u=pjH8+g@mail.gmail.com>
Subject: [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure
From: =?UTF-8?Q?C=C3=A9dric_Champeau?= <cchampeau@apache.org>
To: users@groovy.incubator.apache.org, dev@groovy.incubator.apache.org
Cc: security@apache.org, oss-security@lists.openwall.com,
	bugtraq@securityfocus.com
Content-Type: multipart/alternative; boundary=001a11347cfad6bad8051afb2aff

--001a11347cfad6bad8051afb2aff
Content-Type: text/plain; charset=UTF-8

*Severity*: Important

*Vendor*: The Apache Software Foundation
*Versions Affected*:

All unsupported versions ranging from 1.7.0 to 2.4.3.

*Impact*

Remote execution of untrusted code, DoS

*Description*

When an application has Groovy on classpath and that it uses standard Java
serialization mechanims to communicate between servers, or to store local
data, it is possible for an attacker to bake a special serialized object
that will execute code directly when deserialized. All applications which
rely on serialization and do not isolate the code which deserializes
objects are subject to this vulnerability.

*Mitigation*

Apache Groovy 2.4.4 is the first and only supported release under the
Apache Software Foundation. It is strongly recommanded that all users
upgrade to this version. If you cannot upgrade or rely on an older,
unsupported version of Groovy, you can apply the following patch on the
MethodClosure class
(src/main/org/codehaus/groovy/runtime/MethodClosure.java):

 public class MethodClosure extends Closure {
+    private Object readResolve() {
+        throw new UnsupportedOperationException();
+    }

*Credit*

This vulnerability was discovered by:

   cpnrodzc7 working with HP's Zero Day Initiative

*References*

http://groovy-lang.org/security.html

--001a11347cfad6bad8051afb2aff
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p><b>Severity</b>: Important

</p><p><b>Vendor</b>:
The Apache Software Foundation

</p><b>Versions Affected</b>:<br><br>All unsupported versions ranging from =
1.7.0 to 2.4.3.<br><div><br></div><div><b>Impact</b><br><br></div><div>Remo=
te execution of untrusted code, DoS<br></div><div><br></div><div><b>Descrip=
tion</b><br><br></div><div>When
 an application has Groovy on classpath and that it uses standard Java=20
serialization mechanims to communicate between servers, or to store=20
local data, it is possible for an attacker to bake a special serialized=20
object that will execute code directly when deserialized. All=20
applications which rely on serialization and do not isolate the code=20
which deserializes objects are subject to this vulnerability.<br></div><div=
><br></div><div><b>Mitigation</b><br><br></div><div>Apache
 Groovy 2.4.4 is the first and only supported release under the Apache=20
Software Foundation. It is strongly recommanded that all users upgrade=20
to this version. If you cannot upgrade or rely on an older, unsupported=20
version of Groovy, you can apply the following patch on the=20
MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.jav=
a):<span class=3D"im"><br><br>=C2=A0public class MethodClosure extends Clos=
ure {<br></span>+=C2=A0=C2=A0=C2=A0 private Object readResolve() {<br>+=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 throw new UnsupportedOperationExcep=
tion();<br>+=C2=A0=C2=A0=C2=A0 }<br><br></div><b>Credit</b><br><br><span cl=
ass=3D"im">This vulnerability was discovered by:<br>
<br></span><span class=3D"im">
=C2=A0 =C2=A0cpnrodzc7 working with HP&#39;s Zero Day Initiative<br><br></s=
pan><b>References</b><br><br><a href=3D"http://groovy-lang.org/security.htm=
l" target=3D"_blank">http://groovy-lang.org/security.html</a></div>

--001a11347cfad6bad8051afb2aff--