var-201403-0506
Vulnerability from variot

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. ** Delete ** This case JVNDB-2014-000045 It was removed because it was found to be duplicated. JVNDB-2014-000045 Please refer to. Apache Struts is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Apache Struts versions 2.0.0 through 2.3.16 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


               VMware Security Advisory

Advisory ID: VMSA-2014-0007 Synopsis: VMware product updates address security vulnerabilities in Apache Struts library Issue date: 2014-06-24 Updated on: 2014-06-24 (Initial Advisory) CVE number: CVE-2014-0050, CVE-2014-0094, CVE-2014-0112


  1. Summary

    VMware product updates address security vulnerabilities in Apache Struts library

  2. Relevant releases

    VMware vCenter Operations Management Suite prior to 5.8.2

  3. Problem Description

a. The Apache Struts library is updated to version 2.3.16.2 to address multiple security issues.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)
  has assigned the names CVE-2014-0050, CVE-2014-0094, and
  CVE-2014-0112 to these issues.

  CVE-2014-0112 may lead to remote code execution. This issue was 
  found to be only partially addressed in CVE-2014-0094.

  CVE-2014-0050 may lead to a denial of service condition.

  vCenter Operations Management Suite (vCOps) is affected by both 
  CVE-2014-0112 and CVE-2014-0050. Exploitation of CVE-2014-0112
  may lead to remote code execution without authentication.

  vCenter Orchestrator (vCO) is affected by CVE-2014-0050 and not 
  by CVE-2014-0112.

  Workaround

  A workaround for CVE-2014-0112 is documented in VMware Knowledge Base
  article 2081470.


  Column 4 of the following table lists the action required to
  remediate the vulnerability in each release, if a solution is 
  available.

  VMware         Product    Running Replace with/
  Product        Version    on  Apply Patch
  =============  =======    ======= =================
  vCOPS      5.8.x  any     vCOPS 5.8.2
  vCOPS          5.7.x      any     patch pending *

  vCO            5.5        any     patch pending
  vCO            5.1        any     patch pending
  vCO            4.2        any     patch pending

  *Customers are advised to apply the workaround or update to vCOps

5.8.2.

  1. Solution

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

vCenter Operations Management Suite 5.8.2


Downloads and Documentation: https://www.vmware.com/go/download-vcops

  1. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0112

http://kb.vmware.com/kb/2081470


  1. Change log

2014-06-24 VMSA-2014-0007 Initial security advisory in conjunction with the release of vCenter Operations Management Suite 5.8.2 on 2014-06-24.


  1. Contact

E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org

E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055

VMware Security Advisories http://www.vmware.com/security/advisories

VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html

Twitter https://twitter.com/VMwareSRC

Copyright 2014 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15337) Charset: utf-8

wj8DBQFTqi0BDEcm8Vbi9kMRAnCKAJ9otVO7DlXuMnSEGh2TLBzS5hniKgCeMnAM CZ5+DYZAydCjMwVgtKqoo7Y= =Vwu5 -----END PGP SIGNATURE-----

Show details on source website


{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201403-0506",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "struts",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "apache",
        "version": "2.3.16.1"
      },
      {
        "model": "struts",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "apache",
        "version": "2.0.0"
      },
      {
        "model": "integrated system ha database ready",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "business analytics modeling server"
      },
      {
        "model": "interstage",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "business process manager analytics"
      },
      {
        "model": "interstage",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "extreme transaction processing server"
      },
      {
        "model": "interstage",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "mobile manager"
      },
      {
        "model": "interstage application development cycle manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage application framework suite",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage application server",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage apworks",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage business application server",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage job workload server",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage service integrator",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "interstage studio",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "serverview",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "resource orchestrator"
      },
      {
        "model": "symfoware",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "analytics server"
      },
      {
        "model": "symfoware",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "server"
      },
      {
        "model": "systemwalker service catalog manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "systemwalker service quality coordinator",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "systemwalker software configuration manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "triole",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": "cloud middle set  b set"
      },
      {
        "model": "cloud infrastructure management software",
        "scope": null,
        "trust": 0.8,
        "vendor": "fujitsu",
        "version": null
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.12"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.14.2"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.0.11.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.15.1"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.14"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.15.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.14.3"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.3.15"
      },
      {
        "model": "struts",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apache",
        "version": "2.0.11.2"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.11"
      },
      {
        "model": "storwize unified",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.3.0.0"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.1.2"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2.11"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.7"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.8"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.2"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.4"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.3"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.6"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.5"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.14"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2.3.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.9"
      },
      {
        "model": "storwize unified",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.3.1.0"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.8"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.3.1.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.3"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.8.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.4"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.2"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.5"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.12"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.1.6"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.13"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.10"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.11.2"
      },
      {
        "model": "storwize unified",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "v70001.3.0.5"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.0.11.1"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2.3"
      },
      {
        "model": "software foundation struts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apache",
        "version": "2.2"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "65999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.3.16.1",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mark Thomas and Przemyslaw Celej",
    "sources": [
      {
        "db": "BID",
        "id": "65999"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0094",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-0094",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-0094",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201403-191",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-0094",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to \"manipulate\" the ClassLoader via the class parameter, which is passed to the getClass method. ** Delete ** This case JVNDB-2014-000045 It was removed because it was found to be duplicated. JVNDB-2014-000045 Please refer to. Apache Struts is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. \nApache Struts versions 2.0.0 through 2.3.16 are vulnerable. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- ------------------------------------------------------------------------\n                   VMware Security Advisory\n\nAdvisory ID: VMSA-2014-0007\nSynopsis:    VMware product updates address security vulnerabilities in \n             Apache Struts library \nIssue date:  2014-06-24\nUpdated on:  2014-06-24 (Initial Advisory)\nCVE number:  CVE-2014-0050, CVE-2014-0094, CVE-2014-0112\n- ------------------------------------------------------------------------\n\n1. Summary\n\n    VMware product updates address security vulnerabilities in Apache \n    Struts library\n\n2. Relevant releases\n\n    VMware vCenter Operations Management Suite prior to 5.8.2\n\n3. Problem Description\n\n   a. The Apache Struts library is updated to version 2.3.16.2 to \n      address multiple security issues. \n\n      The Common Vulnerabilities and Exposures project (cve.mitre.org)\n      has assigned the names CVE-2014-0050, CVE-2014-0094, and\n      CVE-2014-0112 to these issues. \n\n      CVE-2014-0112 may lead to remote code execution. This issue was \n      found to be only partially addressed in CVE-2014-0094. \n\n      CVE-2014-0050 may lead to a denial of service condition. \n\n      vCenter Operations Management Suite (vCOps) is affected by both \n      CVE-2014-0112 and CVE-2014-0050. Exploitation of CVE-2014-0112\n      may lead to remote code execution without authentication. \n\n      vCenter Orchestrator (vCO) is affected by CVE-2014-0050 and not \n      by CVE-2014-0112. \n\n      Workaround\n\n      A workaround for CVE-2014-0112 is documented in VMware Knowledge Base\n      article 2081470. \n\n\n      Column 4 of the following table lists the action required to\n      remediate the vulnerability in each release, if a solution is \n      available. \n\n      VMware         Product\tRunning\tReplace with/\n      Product        Version\ton\tApply Patch\n      =============  =======\t=======\t=================\n      vCOPS\t     5.8.x \tany \tvCOPS 5.8.2\n      vCOPS          5.7.x      any     patch pending *\n\n      vCO            5.5        any     patch pending\n      vCO            5.1        any     patch pending\n      vCO            4.2        any     patch pending\n\n      *Customers are advised to apply the workaround or update to vCOps\n5.8.2. \n\n4. Solution\n\n   Please review the patch/release notes for your product and version \n   and verify the checksum of your downloaded file. \n\n   vCenter Operations Management Suite 5.8.2\n   -----------------------------------------\n   Downloads and Documentation:\n   https://www.vmware.com/go/download-vcops\n   \n5. References\n\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0094\n   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0112\n\n   http://kb.vmware.com/kb/2081470\n\n- ------------------------------------------------------------------------\n\n6. Change log\n\n   2014-06-24 VMSA-2014-0007\n   Initial security advisory in conjunction with the release of vCenter\n   Operations Management Suite 5.8.2 on 2014-06-24. \n\n- ------------------------------------------------------------------------\n\n7. Contact\n\n   E-mail list for product security notifications and announcements:\n   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce\n\n   This Security Advisory is posted to the following lists:\n\n    security-announce at lists.vmware.com\n    bugtraq at securityfocus.com\n    fulldisclosure at seclists.org\n\n   E-mail: security at vmware.com\n   PGP key at: http://kb.vmware.com/kb/1055\n\n   VMware Security Advisories\n   http://www.vmware.com/security/advisories\n\n   VMware Security Response Policy\n   https://www.vmware.com/support/policies/security_response.html\n\n   VMware Lifecycle Support Phases\n   https://www.vmware.com/support/policies/lifecycle.html\n \n   Twitter\n   https://twitter.com/VMwareSRC\n\n   Copyright 2014 VMware Inc.  All rights reserved. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: Encryption Desktop 10.3.2 (Build 15337)\nCharset: utf-8\n\nwj8DBQFTqi0BDEcm8Vbi9kMRAnCKAJ9otVO7DlXuMnSEGh2TLBzS5hniKgCeMnAM\nCZ5+DYZAydCjMwVgtKqoo7Y=\n=Vwu5\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "db": "BID",
        "id": "65999"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "db": "PACKETSTORM",
        "id": "127215"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=41690",
        "trust": 0.2,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0094",
        "trust": 2.9
      },
      {
        "db": "SECTRACK",
        "id": "1029876",
        "trust": 2.4
      },
      {
        "db": "BID",
        "id": "65999",
        "trust": 1.9
      },
      {
        "db": "PACKETSTORM",
        "id": "127215",
        "trust": 1.7
      },
      {
        "db": "JVN",
        "id": "JVN19294237",
        "trust": 1.6
      },
      {
        "db": "SECUNIA",
        "id": "56440",
        "trust": 1.6
      },
      {
        "db": "SECUNIA",
        "id": "59178",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-000045",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0094",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "db": "BID",
        "id": "65999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "db": "PACKETSTORM",
        "id": "127215"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "id": "VAR-201403-0506",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.1875
  },
  "last_update_date": "2024-04-20T19:59:14.400000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "S2-021",
        "trust": 0.8,
        "url": "http://struts.apache.org/release/2.3.x/docs/s2-021.html"
      },
      {
        "title": "S2-020",
        "trust": 0.8,
        "url": "http://struts.apache.org/release/2.3.x/docs/s2-020.html"
      },
      {
        "title": "CVE-2014-0094 \u4ed6 \u306b\u95a2\u3059\u308b\u5f71\u97ff",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/vulnerabilities/cve2014-0094-0114.html"
      },
      {
        "title": "Interstage BPMA\u4ed6 CVE-2014-0094",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_bpma201401.html"
      },
      {
        "title": "Interstage Application Development Cycle Manager(ADM): struts\u306e\u8106\u5f31\u6027(CVE-2014-0094) (2014\u5e745\u670827\u65e5)",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_aplidevcyclemgr_201401.html"
      },
      {
        "title": "Symfoware Server\uff08Open\u30a4\u30f3\u30bf\u30d5\u30a7\u30fc\u30b9\uff09: Struts\u306e\u8106\u5f31\u6027(CVE-2014-0094, CVE-2014-0112, CVE-2014-0113, CVE-2014-0116) (2014\u5e746\u67082\u65e5)",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/products-fujitsu/solution/symfoware_201402.html"
      },
      {
        "title": "struts-2.3.16.1-all",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=48603"
      },
      {
        "title": "Debian CVElist Bug Report Logs: libstruts1.2-java: CVE-2014-0114",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=96f4091aa31a0ece729fdcb110066df5"
      },
      {
        "title": "Red Hat: CVE-2014-0094",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2014-0094"
      },
      {
        "title": "VMware Security Advisories: VMware product updates address security vulnerabilities in Apache Struts library",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories\u0026qid=3f8f92a767d3e2773247be2d5077cbee"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - April 2015",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=4b527561ba1a5de7a529c8a93679f585"
      },
      {
        "title": "CVE-2014-0094-test-program-for-struts1",
        "trust": 0.1,
        "url": "https://github.com/hasegawatadamitsu/cve-2014-0094-test-program-for-struts1 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "http://www.securitytracker.com/id/1029876"
      },
      {
        "trust": 1.6,
        "url": "http://jvn.jp/en/jp/jvn19294237/index.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/archive/1/532549/100/0/threaded"
      },
      {
        "trust": 1.6,
        "url": "http://jvndb.jvn.jp/jvndb/jvndb-2014-000045"
      },
      {
        "trust": 1.6,
        "url": "http://www.vmware.com/security/advisories/vmsa-2014-0007.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/archive/1/531362/100/0/threaded"
      },
      {
        "trust": 1.6,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"
      },
      {
        "trust": 1.6,
        "url": "http://secunia.com/advisories/59178"
      },
      {
        "trust": 1.6,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676706"
      },
      {
        "trust": 1.6,
        "url": "http://secunia.com/advisories/56440"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/65999"
      },
      {
        "trust": 1.6,
        "url": "http://packetstormsecurity.com/files/127215/vmware-security-advisory-2014-0007.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.konakart.com/downloads/ver-7-3-0-0-whats-new"
      },
      {
        "trust": 1.6,
        "url": "http://struts.apache.org/release/2.3.x/docs/s2-020.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
      },
      {
        "trust": 0.9,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0094"
      },
      {
        "trust": 0.8,
        "url": "http://www.ipa.go.jp/security/ciadr/vul/20140417-struts.html"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0094"
      },
      {
        "trust": 0.3,
        "url": "http://struts.apache.org/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0050"
      },
      {
        "trust": 0.1,
        "url": "https://twitter.com/vmwaresrc"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0112"
      },
      {
        "trust": 0.1,
        "url": "https://www.vmware.com/support/policies/lifecycle.html"
      },
      {
        "trust": 0.1,
        "url": "http://kb.vmware.com/kb/2081470"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0112"
      },
      {
        "trust": 0.1,
        "url": "http://kb.vmware.com/kb/1055"
      },
      {
        "trust": 0.1,
        "url": "http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce"
      },
      {
        "trust": 0.1,
        "url": "https://www.vmware.com/support/policies/security_response.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.vmware.com/security/advisories"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0050"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0094"
      },
      {
        "trust": 0.1,
        "url": "https://www.vmware.com/go/download-vcops"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "65999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "db": "PACKETSTORM",
        "id": "127215"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "db": "BID",
        "id": "65999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "db": "PACKETSTORM",
        "id": "127215"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-03-11T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "date": "2014-03-06T00:00:00",
        "db": "BID",
        "id": "65999"
      },
      {
        "date": "2014-03-12T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "date": "2014-06-25T21:34:12",
        "db": "PACKETSTORM",
        "id": "127215"
      },
      {
        "date": "2014-03-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "date": "2014-03-11T13:00:37.107000",
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-08-12T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0094"
      },
      {
        "date": "2015-07-15T00:14:00",
        "db": "BID",
        "id": "65999"
      },
      {
        "date": "2014-06-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      },
      {
        "date": "2019-08-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      },
      {
        "date": "2019-08-12T21:15:12.140000",
        "db": "NVD",
        "id": "CVE-2014-0094"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "** Delete  ** Apache Struts of  ParametersInterceptor In  ClassLoader Vulnerability manipulated",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001603"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201403-191"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading...

Loading...

Loading...
  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.