PT-2018-11443 · Apache+1 · Apache Jmeter+1

Publicado 2018-02-14 · Atualizado 2022-05-13 · CVE-2018-1287

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache JMeter versions 2.X through 3.X

Description The issue arises when Apache JMeter is used in Distributed Test mode, which is RMI-based. In this scenario, the jmeter server binds the RMI Registry to a wildcard host, potentially allowing an attacker to access the JMeterEngine and send unauthorized code. This vulnerability is based on the architectural assumption that JMeter is operating on a 'safe' network where all users with access are considered trusted.

Recommendations For Apache JMeter versions 2.X through 3.X, consider restricting access to the RMI Registry to minimize the risk of exploitation, especially when operating in Distributed Test mode. As a temporary workaround, limit the network access to trusted users only, aligning with JMeter's architectural assumption of a 'safe' network.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2018-1287

GHSA-J7J7-G4WW-PXG5

Produtos afetados

Apache Jmeter

Debian

Referências · 19

• https://github.com/apache/jmeter · Nota
• https://github.com/apache/jmeter/issues/4677 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1287 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2018-1287 · Nota de Segurança
• https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E · Nota
• https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-1287 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j7j7-g4ww-pxg5 · Aviso do Fabricante
• http://securityfocus.com/bid/103068 · Nota
• http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1287 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1287 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2018/02/11/2 · Nota
• https://packages.debian.org/src:jakarta-jmeter · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1287 · Aviso do Fabricante