Mailing-List: contact dev-help@myfaces.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "MyFaces Development" <dev@myfaces.apache.org>
MIME-Version: 1.0
Sender: mkienenb@gmail.com
In-Reply-To: <CAM1yOjZV28=4LFjZtYWPB5W6HXRzxVttU2eXaUzCfUyLakN4Zg@mail.gmail.com>
References: <CAM1yOjZV28=4LFjZtYWPB5W6HXRzxVttU2eXaUzCfUyLakN4Zg@mail.gmail.com>
From: Mike Kienenberger <mkienenb@apache.org>
Date: Thu, 29 Sep 2016 13:02:45 -0400
Message-ID: <CAM1yOjYM+EW3mLUfX0pNAVLfUFRAw-Bhvkp3UE5=EQzR8Yxsfw@mail.gmail.com>
Subject: Re: CVE-2016-5019: MyFaces Trinidad view state deserialization
 security vulnerability
To: announce@myfaces.apache.org, MyFaces Development <dev@myfaces.apache.org>,
	MyFaces Discussion <users@myfaces.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
archived-at: Thu, 29 Sep 2016 17:03:13 -0000

Clarification: The first line in this CVE [1] was a copy&paste error
during message composition and is not part of the CVE.  This line can
make it sound as if CVE-2016-5019 is only an information disclosure
vulnerability rather than a deserialization attack vector.  I
apologize for the confusion.

On Thu, Sep 29, 2016 at 11:50 AM, Mike Kienenberger <mkienenb@gmail.com> wr=
ote:
> CVE-2016-5019 Apache MyFaces Trinidad information disclosure vulnerabilit=
y
>
> Severity: Important
>
> Vendor:
> The Apache Software Foundation
>
> Versions Affected:
> Trinidad from 1.0.0 to 1.0.13
> Trinidad from 1.2.1 to 1.2.14
> Trinidad from 2.0.0 to 2.0.1
> Trinidad from 2.1.0 to 2.1.1
>
> Description:
>
> Trinidad=E2=80=99s CoreResponseStateManager both reads and writes view st=
ate
> strings using
> ObjectInputStream/ObjectOutputStream directly.  By doing so, Trinidad
> bypasses the
> view state security features provided by the JSF implementations - ie. th=
e view
> state is not encrypted and is not MAC=E2=80=99ed.
>
> Trinidad=E2=80=99s CoreResponseStateManager will blindly deserialize untr=
usted
> view state
> strings, which makes Trinidad-based applications vulnerable to deserializ=
ation
> attacks.
>
> Mitigation:
>
> All users of Apache Trinidad should upgrade to either 2.1.2, 2.0.2, or
> 1.2.15 and
> enable view state encryption using org.apache.myfaces.USE_ENCRYPTION and =
related
> web configuration parameters.
> See http://wiki.apache.org/myfaces/Secure_Your_Application for details.
>
> Upgrading all Commons Collections jars on the class path to 3.2.2/4.1
> will prevent
> certain well-known vectors of attack, but will not entirely resolve this =
issue.
>
> References:
> https://issues.apache.org/jira/browse/TRINIDAD-2542
>
> This issue was discovered by Teemu K=C3=A4=C3=A4ri=C3=A4inen and reported=
 by Andy Schwartz