Bug 1724989 (CVE-2019-10185) - CVE-2019-10185 icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite
Summary: CVE-2019-10185 icedtea-web: directory traversal in the nested jar auto-extrac...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-10185
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20190731:1341...
Depends On: 1725946 1725948 1732552 1734804 1725945 1725947
Blocks: 1724963
TreeView+ depends on / blocked
 
Reported: 2019-06-28 08:24 UTC by Marian Rehak
Modified: 2019-08-15 01:37 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.
Clone Of:
Environment:
Last Closed: 2019-07-31 19:18:23 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2003 None None None 2019-07-31 19:13:04 UTC
Red Hat Product Errata RHSA-2019:2004 None None None 2019-07-31 17:52:14 UTC

Description Marian Rehak 2019-06-28 08:24:23 UTC
The nested jar auto-extraction feature is vulnerable to "zip-slip" attacks, resulting in directory traversal. 

A specially crafted JAR file could use this flaw to write and overwrite arbitrary files. Combined with CVE-2019-10181, it can be used to rewriting the main Java application, which could possibly be used to escape the sandbox.

Comment 4 Cedric Buissart 🐶 2019-07-22 06:48:26 UTC
Acknowledgments:

Name: Imre Rad

Comment 11 Cedric Buissart 🐶 2019-07-31 13:42:47 UTC
Created icedtea-web tracking bugs for this issue:

Affects: fedora-all [bug 1734804]

Comment 12 errata-xmlrpc 2019-07-31 17:52:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2004 https://access.redhat.com/errata/RHSA-2019:2004

Comment 13 errata-xmlrpc 2019-07-31 19:13:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2003 https://access.redhat.com/errata/RHSA-2019:2003

Comment 14 Product Security DevOps Team 2019-07-31 19:18:23 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10185

Comment 15 Cedric Buissart 🐶 2019-08-01 08:42:34 UTC
Mitigation:

No known mitigation.


Note You need to log in before you can comment on or make changes to this bug.