Bug 995275 (CVE-2013-4221)

Summary:	CVE-2013-4221 Restlet: remote code execution due to insecure XML deserialization
Product:	[Other] Security Response	Reporter:	David Jorm <djorm>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	chazlett, mjc, weli
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-12-20 00:13:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1012733
Bug Blocks:	994927, 996321, 1015403

Description David Jorm 2013-08-08 23:27:05 UTC

Restlet applications which use ObjectRepresentation to map HTTP request data directly to an object will deserialize arbitrary user-provided XML using XMLDecoder. XMLDecoder will deserialize an attacker-provided definition of a class and execute its methods. A remote attacker could use this flaw to perform remote code execution in the context of the server running the Restlet application.

Comment 1 David Jorm 2013-08-09 01:34:14 UTC

Upstream Bug:

https://github.com/restlet/restlet-framework-java/issues/774

External References:

http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
http://restlet.org/learn/2.1/changes

Comment 3 Chess Hazlett 2013-09-25 01:43:56 UTC


*** This bug has been marked as a duplicate of bug 1011726 ***

Comment 4 Chess Hazlett 2013-09-25 01:47:53 UTC

erroneously marked as duplicate.

Comment 5 David Jorm 2013-09-27 02:18:13 UTC

This flaw is resolved in restlet 2.1.4, by disabling the vulnerable use cases.

Comment 6 errata-xmlrpc 2013-10-07 17:19:00 UTC

This issue has been addressed in following products:

  Red Hat JBoss Fuse 6.0.0

Via RHSA-2013:1410 https://rhn.redhat.com/errata/RHSA-2013-1410.html

Comment 8 errata-xmlrpc 2013-12-19 22:50:44 UTC

This issue has been addressed in following products:

  Fuse ESB Enterprise 7.1.0

Via RHSA-2013:1862 https://rhn.redhat.com/errata/RHSA-2013-1862.html