绿盟科技网络安全威胁周报2017.36 Struts2远程代码执行漏洞（S2-052）CVE-2017-9805-CSDN博客

绿盟科技发布了本周安全通告，周报编号NSFOCUS-17-36，绿盟科技漏洞库本周新增29条，其中高危6条。本次周报建议大家关注 Apache Struts2远程代码执行漏洞（S2-052） 。Struts2 REST插件的XStream组件对XML格式的数据包进行反序列化操作时，未对数据内容进行有效验证，存在安全隐患，可被远程攻击。该漏洞利用简单、危害较大、影响面较广，请用户及时排查是否收到影响，若受影响，需到 Apache官方网站下载升级补丁，修复漏洞。

焦点漏洞

Apache Struts2远程代码执行漏洞（S2-052）

NSFOCUS ID 37544
CVE ID CVE-2017-9805

受影响版本

Apache Group Struts 2.5-2.5.12
Apache Group Struts 2.1.2-2.3.33

漏洞点评

Struts2 是构建企业级Jave Web应用的可扩展框架，被大量金融、电信等企业客户采用。但近日，Struts2的REST插件被发现存在远程代码执行漏洞。Struts2 REST插件的XStream组件对XML格式的数据包进行反序列化操作时，未对数据内容进行有效验证，存在安全隐患，可被远程攻击。该漏洞利用简单、危害较大、影响面较广，请用户及时排查是否收到影响，若受影响，需到 Apache官方网站下载升级补丁，修复漏洞。

（数据来源：绿盟科技安全研究部&产品规则组）

互联网安全态势

CVE统计

最近一周CVE公告总数与前期相比有所上升。值得关注的高危漏洞如下：

威胁信息回顾

标题：A code execution flaw in LabVIEW will remain unpatched
- 时间：2017-09-03
- 摘要：Security researchers at Cisco Talos have discovered a code execution issue in LabVIEW software that will remain unpatched.
- 链接：http://securityaffairs.co/wordpress/62588/hacking/labview-code-execution-flaw.html
标题： Taringa: Over 28 Million Users’ Data Exposed in Massive Data Breach
- 时间：2017-09-04
- 摘要：Exclusive — If you have an account on Taringa, also known as “The Latin American Reddit,” your account details may have compromised in a massive data breach that leaked login details of almost all of its over 28 million users.
- 链接：http://thehackernews.com/2017/09/taringa-data-breach-hacking.html
标题：Critical Flaw in Apache Struts2 Lets Hackers Take Over Web Servers
- 时间：2017-09-05
- 摘要：Security researchers have discovered a critical remote code execution vulnerability in the popular Apache Struts web application framework, allowing a remote attacker to run malicious code on the affected servers.
- 链接：http://thehackernews.com/2017/09/apache-struts-vulnerability.html
标题：Apache Software Foundation Releases Security Update
- 时间：2017-09-06
- 摘要：US-CERT encourages users and administrators to review the Apache Security Bulletin and Vulnerability Note VU#112992 and upgrade to Struts 2.5.13.
- 链接：https://www.us-cert.gov/ncas/current-activity/2017/09/06/Apache-Software-Foundation-Releases-Security-Update
标题：European Companies Must Tell Employees If Their Work Emails Are Being Monitored
- 时间：2017-09-05
- 摘要：The European Court of Human Rights (ECHR) on Tuesday gave a landmark judgement concerning privacy in the workplace by overturning an earlier ruling that gave employers the right to spy on workplace communications.
- 链接：http://thehackernews.com/2017/09/employee-monitoring.html
标题：Experts discover a new sophisticated malware dubbed xRAT tied to mRAT threat
- 时间：2017-09-05
- 摘要：Researchers at Lookout spotted a new mobile remote access Trojan dubbed xRAT tied to 2014 “Xsser / mRAT” surveillance campaign against Hong Kong protesters.
- 链接：http://securityaffairs.co/wordpress/62737/malware/xrat-malware.html
标题： Military Contractor’s Vendor Leaks Resumes in Misconfigured AWS S3
- 时间：2017-09-05
- 摘要：Thousands of resumes and job applications containing the personal information of U.S. veterans, many with top secret clearances, and law enforcement officers were left exposed in an Amazon Web Services S3 bucket, continuing a trend where poorly configured cloud-storage services are putting people at risk.
- 链接：https://threatpost.com/military-contractors-vendor-leaks-resumes-in-misconfigured-aws-s3/127803/
标题：XPwn2017
- 时间：2017-09-06
- 摘要：2017年9月6日，由XCon组委会、北京未来安全信息技术有限公司联合主办，蚂蚁金服安全应急响应中心、百度安全共同支持的“XPwn2017 未来安全探索盛会”在北京隆重召开。本届盛会以“极智·未来”为主题广邀国内外信息安全爱好者、信息安全工作者以及信息安全行业专家共赴安全“极智”盛宴。
- 链接：http://www.ijiandao.com/safe/it/68488.html
标题： Mobile Bootloaders From Top Manufacturers Found Vulnerable to Persistent Threats
- 时间：2017-09-05
- 摘要：Security researchers have discovered several severe zero-day vulnerabilities in the mobile bootloaders from at least four popular device manufacturers that could allow an attacker to gain persistent root access on the device.
- 链接：http://thehackernews.com/2017/09/hacking-android-bootloader-unlock.html
标题： Dragonfly 2.0 Gains Operational Access to U.S. Energy Companies
- 时间：2017-09-05
- 摘要：Hacker group Dragonfly 2.0 just breached U.S. and European energy companies, gaining operational access to power grids. This recent infiltration allows hackers to “flip the switch” at power companies, stopping electricity flow to homes and business in the U.S.
- 链接：http://resources.infosecinstitute.com/dragonfly-2-0-gains-operational-access-u-s-energy-companies/
标题：WireX Variant Capable of UDP Flood Attacks
- 时间：2017-09-06
- 摘要：The WireX botnet presented defenders with many superlatives: the largest mobile botnet ever; hundreds of mobile apps spreading application-layer DDoS malware; unprecedented cooperation between technology companies—even competitors—to halt some of its activities.
- 链接：https://threatpost.com/wirex-variant-capable-of-udp-flood-attacks/127825/
标题： Breach at Equifax May Impact 143M Americans
- 时间：2017-09-06
- 摘要：Equifax, one of the “big-three” U.S. credit bureaus, said today a data breach at the company may have affected 143 million Americans, jeopardizing consumer Social Security numbers, birth dates, addresses and some driver’s license numbers.
- 链接：https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/
标题：Wikileaks Unveils Project Protego: CIA’s Secret Missile Control System
- 时间：2017-09-07
- 摘要：Every week since March Wikileaks has been leaking secrets from the United States Central Intelligence Agency (CIA), which mainly focus on surveillance techniques and hacking tools employed by its agents.
- 链接：Every week since March Wikileaks has been leaking secrets from the United States Central Intelligence Agency (CIA), which mainly focus on surveillance techniques and hacking tools employed by its agents.

（数据来源：绿盟科技威胁情报与网络安全实验室收集整理）

漏洞研究

漏洞库统计

截止到2017年9月8日，绿盟科技漏洞库已收录总条目达到37561条。本周新增漏洞记录29条，其中高危漏洞数量6条，中危漏洞数量16条，低危漏洞数量7条。

McAfee LiveSafe (MLS) 中间人攻击漏洞（CVE-2017-3898）
- 危险等级:中
- cve编号:CVE-2017-3898
McAfee LiveSafe (MLS) 代码注入漏洞（CVE-2017-3897）
- 危险等级:中
- cve编号:CVE-2017-3897
ImageMagick ReadBMPImage 拒绝服务漏洞（CVE-2017-12693）
- 危险等级:低
- cve编号:CVE-2017-12693
QEMU 拒绝服务漏洞（CVE-2017-13711）
- 危险等级:中
- BID:100534
- cve编号:CVE-2017-13711
ImageMagick ReadVIFFImage 拒绝服务漏洞（CVE-2017-12692）
- 危险等级:低
- cve编号:CVE-2017-12692
Linux kernel tcp_disconnect拒绝服务漏洞（CVE-2017-14106）
- 危险等级:中
- cve编号:CVE-2017-14106
ImageMagick ReadOneLayer 拒绝服务漏洞（CVE-2017-12691）
- 危险等级:低
- cve编号:CVE-2017-12691
gdk-pixbuf整数溢出及堆缓冲区溢出漏洞
- 危险等级:高
- BID:100541
- cve编号:CVE-2017-2870,CVE-2017-2862
phpFileManager 任意命令执行漏洞（CVE-2015-5958）
- 危险等级:中
- cve编号:CVE-2015-5958
ImageMagick WriteMSLImage内存泄露漏洞（CVE-2017-14139）
- 危险等级:低
- cve编号:CVE-2017-14139
ImageMagick ReadWEBPImage内存泄露漏洞（CVE-2017-14138）
- 危险等级:低
- cve编号:CVE-2017-14138
Apache Struts2远程代码执行漏洞（S2-052）（CVE-2017-9805）
- 危险等级:高
- cve编号:CVE-2017-9805
Linux kernel atyfb_ioctl函数信息泄露漏洞（CVE-2017-14156）
- 危险等级:低
- cve编号:CVE-2017-14156
GraphicsMagick 拒绝服务漏洞（CVE-2017-13777）
- 危险等级:低
- BID:100575
- cve编号:CVE-2017-13777
GoAhead websDecodeUrl空指针间接引用漏洞（CVE-2017-14149）
- 危险等级:高
- cve编号:CVE-2017-14149
Apache Hadoop信息泄露漏洞（CVE-2016-3086）
- 危险等级:中
- BID:95335
- cve编号:CVE-2016-3086
Foxit Reader XFA gotoURL命令注入远程代码执行漏洞（CVE-2017-10953）
- 危险等级:高
- cve编号:CVE-2017-10953
Bitdefender Internet Security PDF Predictor远程代码执行漏洞（CVE-2017-10954）
- 危险等级:中
- cve编号:CVE-2017-10954
Cisco Prime LAN Management Solution会话固定漏洞（CVE-2017-12225）
- 危险等级:中
- cve编号:CVE-2017-12225
Cisco Emergency Responder SQL注入漏洞（CVE-2017-12227）
- 危险等级:中
- cve编号:CVE-2017-12227
Cisco Unified Communications Manager Trust Verification Service拒绝服务漏洞（CVE-2017-6791）
- 危险等级:中
- cve编号:CVE-2017-6791
Apache Struts拒绝服务漏洞（CVE-2017-9793）
- 危险等级:中
- BID:100611
- cve编号:CVE-2017-9793
SpiderControl SCADA Web Server任意代码执行漏洞（CVE-2017-12728）
- 危险等级:中
- cve编号:CVE-2017-12728
Apache Struts拒绝服务漏洞（CVE-2017-9804）
- 危险等级:中
- BID:100612
- cve编号:CVE-2017-9804
Cisco IR800 Integrated Services Router ROM Monitor输入验证漏洞（CVE-2017-12223）
- 危险等级:高
- cve编号:CVE-2017-12223
Cisco Meeting Server信息泄露漏洞（CVE-2017-12224）
- 危险等级:中
- cve编号:CVE-2017-12224
Cisco Unity Connection反射型跨站脚本漏洞（CVE-2017-12212）
- 危险等级:中
- cve编号:CVE-2017-12212
Cisco IoT Field Network Director内存耗尽拒绝服务漏洞（CVE-2017-6780）
- 危险等级:高
- cve编号:CVE-2017-6780
Cisco ASR 5500 System Architecture Evolution Gateway拒绝服务漏洞（CVE-2017-12217）
- 危险等级:中
- cve编号:CVE-2017-12217