Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1680
Apache Ant insecure temporary file vulnerability
14 May 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Ant
Publisher: Apache
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Modify Arbitrary Files -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-1945
Original Bulletin:
https://ant.apache.org/security.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Windows or UNIX variants (UNIX, Linux, OSX). It
is recommended that administrators running check for an updated
version of the software for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2020-1945: Apache Ant insecure temporary file vulnerability
Severity: Medium
Vendor:
The Apache Software Foundation
Versions Affected:
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7
Description:
Apache Ant uses the default temporary directory identified by the Java
system property java.io.tmpdir for several tasks and may thus leak
sensitive information. The fixcrlf and replaceregexp tasks also copy
files from the temporary directory back into the build tree allowing an
attacker to inject modified source files into the build process.
Mitigation:
Ant users of versions 1.1 to 1.9.14 and 1.10.0 to 1.10.7 should set the
java.io.tmpdir system property to point to a directory only readable and
writable by the current user prior to running Ant.
Users of versions 1.9.15 and 1.10.8 can use the Ant property ant.tmpfile
instead. Users of Ant 1.10.8 can rely on Ant protecting the temporary
files if the underlying filesystem allows it, but we still recommend
using a private temporary directory instead.
Credit:
This issue was discovered by Mike Salvatore of the Ubuntu Security Team.
References:
https://ant.apache.org/security.html
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAl68InYACgkQohFa4V9ri3JMuwCeJCxfVbb0FX7oVgzUpskGH28u
ZIYAoLDKeuyh585wmuiCySIj5EW4hYch
=KIJP
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXrx05GaOgq3Tt24GAQgkkRAAl97kpBmjRPOkhrN29k5P/xGWmgK8fu9W
ASjw5hZ3Ae9yuSbTJVv2+KNsSa1mZwBFuorCEMR2KfGmkUcRw88z1JFiNgXUza77
ByYx5l9IN2X4lXBLzyLxVKoYAUOYygA8jpLK8WThKgjuLZ8ZVxfB1Ilzad57OjYF
0jku3KDdd1bGT7TVJkjVQJ9gbDq2eA3hb+TPqo9K9iDsYWNtAh2lpISgomEmScfp
xPw6+k/na8UXnGa/7o09H/y9sOXkL0s+BF2Fmj6DGeFK2Uix5hhYJWVENBLlNdNe
A3fYRTPoZ8Nd19rUkQ7sWlL2leb50XSyamsyX0IIB2nggCFPMywJ1X7rhKjBjVrO
bePZ0FPLZeKXPutvFFbe/n0YtCkEAPLJeaPJSG7L8EIRG1WpDqOr28kL37k+OuiM
Pwybm27qMXge3hC6TP2kFmh3bGtnbev/nYHuvUJaEBv1dfKQonbgGfKO4zoY3HQf
X2On63P+G1YZfXiexGI/TKJfsQtBi/t0u2KgmXG4F5n5Cr6GOY7nspJN0Xs1JsP2
HTbh279IkKj3Vw9+YBYCyJ7cfv6jBIyK+4HbTKlqf57jkwNFCksYhtnhEHqOPq1K
2iusj5hGEFuyFbtSkmzTAPVKCUROv7bXg139j/ESqO6OgLXy5zMmFkBhYuJsaRYS
5IxKBHwKQ9s=
=1td+
-----END PGP SIGNATURE-----