Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0278
JIRA Security Advisory 2013-02-21
25 February 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Atlassian JIRA
Publisher: Atlassian
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Overwrite Arbitrary Files -- Existing Account
Resolution: Patch/Upgrade
Original Bulletin:
https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2013-02-21
- --------------------------BEGIN INCLUDED TEXT--------------------
JIRA Security Advisory 2013-02-21
Added by Chris LePetit [Atlassian], last edited by Chris LePetit [Atlassian]
on Feb 19, 2013
This advisory discloses a critical severity security vulnerability that exists
in all versions of JIRA up to and including 5.1.4.
Customers who have downloaded and installed JIRA should upgrade their existing
JIRA installations to fix this vulnerability. We also provide a patch that you
will be able to apply to existing installations of JIRA to fix this
vulnerability. However, we recommend that you upgrade your complete JIRA
installation rather than applying the patch.
Enterprise Hosted customers need to request an upgrade by raising a support
request at http://support.atlassian.com in the "Enterprise Hosting Support"
project.
JIRA Studio customers will need to disable SOAP API (see Risk Mitigation below
for details).
Atlassian OnDemand customers are not affected by any of the issues described
in this advisory.
Atlassian is committed to improving product security. The vulnerability listed
in this advisory has been discovered by Atlassian, unless noted otherwise. The
reporter may also have requested that we do not credit them.
If you have questions or concerns regarding this advisory, please raise a
support request at http://support.atlassian.com/.
In this advisory:
* File Overwrite Vulnerability
* Risk Mitigation
* Fix
File Overwrite Vulnerability
Severity
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in Severity Levels for Security Issues. The
scale allows us to rank the severity as critical, high, moderate or low.
This is an independent assessment and you should evaluate its applicability to
your own IT environment.
Description
We have identified and fixed a vulnerability in JIRA's SOAP API that allows an
attacker who has a valid JIRA account to overwrite any files that are
writeable by the OS user JIRA runs under. This may result in the attacker
being able to execute arbitrary Java code in the context of JIRA server.
NOTE: This API is OFF by default, unless you have turned it on. In order to
verify its state, check whether "Accept remote API calls" setting is OFF. This
page describes configuring JIRA options:
https://confluence.atlassian.com/display/JIRA/Configuring+JIRA+Options#ConfiguringJIRAOptions-Options
All versions of JIRA up to and including 5.1.4 are affected by this
vulnerability. The vulnerability is fixed in JIRA 5.1.5 and later. This issue
can be tracked here: JRA-29786
Risk Mitigation
If you're unable to upgrade or patch the instance: as a workaround, the remote
API can be completely disabled by setting the Accept remote API calls value to
OFF in the General Configuration (as in our Configuring JIRA Options
documentation). However, this will disable all XML-RPC or SOAP calls and can
consequently cause additional problems to other applications or scripts that
rely upon the remote API.
Usage of SOAP has been deprecated as of JIRA 5.x, and this can be disabled
without causing problems to JIRA. However versions of JIRA prior to 4.x may
experience problems, such as integrating with other applications through
AppLinks. REST calls will be unaffected.
If you want to continue using SOAP API interface, you need to either upgrade
your JIRA or apply patches.
Fix
This section outlines the upgrades and/or patches for this vulnerability. The
Security Patch Policy describes when and how we release security patches and
security upgrades for our products.
Upgrade (recommended)
The vulnerabilities and fix versions are described in the 'Description'
section above.
We recommend that you upgrade to the latest version of JIRA, if possible. For
a full description of the latest version of JIRA, see the release notes. You
can download the latest version of JIRA from the download centre.
If you cannot upgrade to the latest version of JIRA, you can temporarily patch
your existing installation using the patch listed below. We strongly recommend
upgrading and not patching.
Patches (not recommended)
We recommend patching only when you can neither upgrade nor apply external
security controls. Patches are usually only provided for vulnerabilities of
critical severity (as per our Security Patch Policy), as an interim solution
until you can upgrade. You should not expect that you can continue patching
your system instead of upgrading. Our patches are often non-cumulative we do
not recommend that you apply multiple patches from different advisories on top
of each other, but strongly recommend upgrading to the most recent version
regularly.
If for some reason you cannot upgrade to the latest version of JIRA, you need
do all of the steps described in the patch instructions to fix the
vulnerability described in this security advisory.
Download the patch file for your version of JIRA. Note, the patches are only
available for the point release indicated. If you are using an earlier point
release for a major version, you must upgrade to the latest point release
first. For example, if you have 5.0.6, then you need to upgrade to 5.0.7
before applying this patch.
JIRA Version Patch Patch File Name
5.0.7 http://www.atlassian.com/software/jira/downloads/binary/patch-JRA-29786-5.0.7.zip patch-JRA-29786-5.0.7.zip
5.1.4 http://www.atlassian.com/software/jira/downloads/binary/patch-JRA-29786-5.1.4.zip patch-JRA-29786-5.1.4.zip
Steps for applying the patches can be found inside the zip archive.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUSr/p+4yVqjM2NGpAQL7Gw//XVKSRkKQjxYofaU98o+YCHXt+2eKUS+f
NQgmmgPpMh+A+n50C+y9u4FGGvZut2vzLwOttpK/NeaWiCTCGD/xhA/rIToF0Zys
yM+VoEROzIMtcRDOyKGpDQro4eThJeYKTtoZyEqPbRjMp+/g1jSxpaq2qJc/UzU9
fXFO+IRGyxGjy2yKDOk897mXCPSAG11zQPbRz//PSJ4FIYITy5Mr1eQn5ej80JEd
yQSitIkXgcp8VS0q4Vy/Uf8+kWkaJU0mMXFer6hhQ48An1UU0XSmrQ+5/BEBOYmO
2buIGZwtqMTmzta0tUF2T62JZS88NN/PSv9F5N9uE4axk2IvvcVsjMKrQF6ItXT7
uRi4y2q+M6ucIiWlN5ORGMklVAJ33+FC0fB+zq5IXL5AUEYetxRGq5PQIbtAxRZX
uZsCeX65tRQPSEe0+4ZUNItC6PymZuOqqq+fxKW8Ej+Ekfo4AyZeKKTwR564vgsm
Ng+dPZlDV/OYWZ8VP15f2+cDusGO8ZRrrQT2Em9iat+744z1zgcZqme5Pay7NA5E
zNYqWkzfpQa7Ad2Nff1C60rJQXTHM8QaZN7xCDnH/vgltwPL99B5Z6tFzjXnXS38
FCBuQyWcnX52r2B+gVnBWPw10kOUK//n38cjdhhdvfi6qD3fIgrJ+ajLCon7jRXg
JawuUqNV8FQ=
=vSZf
-----END PGP SIGNATURE-----