Am 01.03.2016 um 14:17 schrieb Sébastien Delafond: > On Feb/26, Markus Koschany wrote: >> Am 19.02.2016 um 13:10 schrieb Stian Soiland-Reyes: >>> Hi, >>> >>> BeanShell aka bsh has released a security fix 2.0b6: >>> >>> https://github.com/beanshell/beanshell/releases/tag/2.0b6 >>> >>> It has been reported to MITRE as CVE-2016-2510. >> >> Hi Stian, >> >> I intend to backport your changes to fix CVE-2016-2510. Looking at the >> relevant commits, I could condense the changes to create the attached >> patch. Could you take a look at it and confirm that this is sufficient? > > Hi Markus, > > now that upstream has validated your patch, do you intend to package and > upload fixed versions for both wheezy- and jessie-security ? In that > case, I'd be happy to validate both your debdiffs prior to your > uploading, and then we can release the DSA. >
Hi Seb, Thanks for your assistance. I'm attaching the proposed debdiff for bsh in Wheezy and Jessie. I can upload anytime. P.S.: If time permits, please let me know how we should proceed with Tomcat 6 in Wheezy. Regards, Markus
diff -Nru bsh-2.0b4/debian/changelog bsh-2.0b4/debian/changelog --- bsh-2.0b4/debian/changelog 2013-11-21 17:29:05.000000000 +0100 +++ bsh-2.0b4/debian/changelog 2016-03-01 15:56:57.000000000 +0100 @@ -1,3 +1,15 @@ +bsh (2.0b4-15+deb8u1) jessie-security; urgency=high + + * Team upload. + * Fix CVE-2016-2510. + An application that includes BeanShell on the classpath may be vulnerable + if another part of the application uses Java serialization or XStream to + deserialize data from an untrusted source. A vulnerable application could + be exploited for remote code execution, including executing arbitrary shell + commands. + + -- Markus Koschany <[email protected]> Tue, 01 Mar 2016 15:54:12 +0100 + bsh (2.0b4-15) unstable; urgency=low * Added the poms missing in the previous upload (Closes: #730008) diff -Nru bsh-2.0b4/debian/patches/CVE-2016-2510.patch bsh-2.0b4/debian/patches/CVE-2016-2510.patch --- bsh-2.0b4/debian/patches/CVE-2016-2510.patch 1970-01-01 01:00:00.000000000 +0100 +++ bsh-2.0b4/debian/patches/CVE-2016-2510.patch 2016-03-01 15:56:57.000000000 +0100 @@ -0,0 +1,44 @@ +From: Markus Koschany <[email protected]> +Date: Fri, 26 Feb 2016 14:24:31 +0100 +Subject: CVE-2016-2510 + +An application that includes BeanShell on the classpath may be vulnerable if +another part of the application uses Java serialization or XStream to +deserialize data from an untrusted source. + +A vulnerable application could be exploited for remote code execution, +including executing arbitrary shell commands. + +https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49 +https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced +--- + src/bsh/XThis.java | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/bsh/XThis.java b/src/bsh/XThis.java +index 3f05974..94bcc22 100644 +--- a/src/bsh/XThis.java ++++ b/src/bsh/XThis.java +@@ -65,7 +65,7 @@ public class XThis extends This + */ + Hashtable interfaces; + +- InvocationHandler invocationHandler = new Handler(); ++ transient InvocationHandler invocationHandler = new Handler(); + + public XThis( NameSpace namespace, Interpreter declaringInterp ) { + super( namespace, declaringInterp ); +@@ -122,8 +122,12 @@ public class XThis extends This + classes aren't there (doesn't it?) This class shouldn't be loaded + if an XThis isn't instantiated in NameSpace.java, should it? + */ +- class Handler implements InvocationHandler, java.io.Serializable ++ class Handler implements InvocationHandler + { ++ private Object readResolve() throws ObjectStreamException { ++ throw new NotSerializableException(); ++ } ++ + public Object invoke( Object proxy, Method method, Object[] args ) + throws Throwable + { diff -Nru bsh-2.0b4/debian/patches/series bsh-2.0b4/debian/patches/series --- bsh-2.0b4/debian/patches/series 2011-12-21 16:07:19.000000000 +0100 +++ bsh-2.0b4/debian/patches/series 2016-03-01 15:56:57.000000000 +0100 @@ -3,3 +3,4 @@ 03_target13_buildXml.patch 04_fix_typo.patch 05_link_javadoc.patch +CVE-2016-2510.patch
diff -Nru bsh-2.0b4/debian/changelog bsh-2.0b4/debian/changelog --- bsh-2.0b4/debian/changelog 2010-06-14 20:46:52.000000000 +0200 +++ bsh-2.0b4/debian/changelog 2016-03-01 15:33:22.000000000 +0100 @@ -1,3 +1,15 @@ +bsh (2.0b4-12+deb7u1) wheezy-security; urgency=high + + * Team upload. + * Fix CVE-2016-2510. + An application that includes BeanShell on the classpath may be vulnerable + if another part of the application uses Java serialization or XStream to + deserialize data from an untrusted source. A vulnerable application could + be exploited for remote code execution, including executing arbitrary shell + commands. + + -- Markus Koschany <[email protected]> Tue, 01 Mar 2016 15:32:04 +0100 + bsh (2.0b4-12) unstable; urgency=low * Build-depend on libservlet2.5-java instead of libservlet2.4-java. diff -Nru bsh-2.0b4/debian/patches/CVE-2016-2510.patch bsh-2.0b4/debian/patches/CVE-2016-2510.patch --- bsh-2.0b4/debian/patches/CVE-2016-2510.patch 1970-01-01 01:00:00.000000000 +0100 +++ bsh-2.0b4/debian/patches/CVE-2016-2510.patch 2016-03-01 15:33:22.000000000 +0100 @@ -0,0 +1,44 @@ +From: Markus Koschany <[email protected]> +Date: Fri, 26 Feb 2016 14:24:31 +0100 +Subject: CVE-2016-2510 + +An application that includes BeanShell on the classpath may be vulnerable if +another part of the application uses Java serialization or XStream to +deserialize data from an untrusted source. + +A vulnerable application could be exploited for remote code execution, +including executing arbitrary shell commands. + +https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49 +https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced +--- + src/bsh/XThis.java | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/bsh/XThis.java b/src/bsh/XThis.java +index 3f05974..94bcc22 100644 +--- a/src/bsh/XThis.java ++++ b/src/bsh/XThis.java +@@ -65,7 +65,7 @@ public class XThis extends This + */ + Hashtable interfaces; + +- InvocationHandler invocationHandler = new Handler(); ++ transient InvocationHandler invocationHandler = new Handler(); + + public XThis( NameSpace namespace, Interpreter declaringInterp ) { + super( namespace, declaringInterp ); +@@ -122,8 +122,12 @@ public class XThis extends This + classes aren't there (doesn't it?) This class shouldn't be loaded + if an XThis isn't instantiated in NameSpace.java, should it? + */ +- class Handler implements InvocationHandler, java.io.Serializable ++ class Handler implements InvocationHandler + { ++ private Object readResolve() throws ObjectStreamException { ++ throw new NotSerializableException(); ++ } ++ + public Object invoke( Object proxy, Method method, Object[] args ) + throws Throwable + { diff -Nru bsh-2.0b4/debian/patches/series bsh-2.0b4/debian/patches/series --- bsh-2.0b4/debian/patches/series 2010-04-16 23:34:45.000000000 +0200 +++ bsh-2.0b4/debian/patches/series 2016-03-01 15:33:22.000000000 +0100 @@ -1,3 +1,4 @@ 01_EnableBsfAdapter_buildXml.patch 02_GNUvms_workaround.patch 03_target13_buildXml.patch +CVE-2016-2510.patch
signature.asc
Description: OpenPGP digital signature
