000035536 - Apache Struts 2 Freemarker Remote Code Execution Vulnerability (CVE-2017-12611) in RSA Products

[#1]

Article Content

Article Number	000035536
Applies To	RSA Product Set: All RSA Products
CVE ID	CVE-2017-12611
Article Summary	On September 7, 2017, Apache disclosed a vulnerability in Apache Struts2 that could allow an attacker to execute arbitrary commands remotely on affected systems by sending a specially crafted web request to the vulnerable application.  The details for this vulnerability can be found at https://struts.apache.org/docs/s2-053.html.
Resolution	RSA is aware of and investigating this issue to identify potential product impact. The level of impact may vary depending on the affected product. The following table contains the latest available impact information. This table will be updated as additional information becomes available.   RSA Product Name Versions Impacted? Details Last Updated 3D Secure / Adaptive Authentication eCommerce All Supported Not Impacted   2017-09-25 Access Manager 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2 Impacted - Remediated Refer to the security advisory ESA-2017-130 on RSA Link. Hotfixes 6.2.4.07, 6.2.3.08, 6.2.2.11, 6.2.1.10, and 6.2.0.24 with a fix for this issue, are available for RSA Access Manager 6.2.x. 2017-10-17 Adaptive Authentication Cloud All Supported Not Impacted   2017-10-02 Adaptive Authentication Hosted All Supported Not Impacted Product does not use impacted version of Apache Struts 2017-09-15 Adaptive Authentication On-Prem 7.x Not Impacted   2017-09-22 Archer Hosted N/A Not Impacted   2017-09-25 Archer Platform All Supported Not Impacted Product does not use Apache Struts. 2017-09-11 Archer SecOps All Supported Not Impacted Product does not use Apache Struts. 2017-09-11 Archer Vulnerability & Risk Manager (VRM) All Supported Not Impacted Product does not use Apache Struts. 2017-09-11 Authentication Manager 8.1, 8.1SP1, 8.2, 8.2SP1 Not Impacted   2017-09-12 Authentication Manager Appliance 8.1, 8.1SP1, 8.2, 8.2SP1 Not Impacted   2017-09-12 BSAFE C Products: MES, Crypto-C ME, SSL-C All Supported Not Impacted Product does not use Apache Struts. 2017-09-14 BSAFE Java Products: Cert-J, Crypto-J, SSL-J All Supported Not Impacted Product does not use Apache Struts. 2017-09-14 Data Loss Prevention All Supported Not Impacted Product does not use Apache Struts. 2017-09-12 Data Protection Manager 3.5.2.5 and earlier Impacted - Remediated Refer to the security advisory ESA-2017-132 on RSA Link. RSA Data Protection Manager 3.5.2.6 with a fix for this issue is available. 2017-10-20 DCS: Certificate Manager All Supported Not Impacted Product does not use Apache Struts. 2017-09-11 DCS: Validation Manager All Supported Not Impacted Does not ship Freemarker Java Template Engine 2017-09-11 ECAT (NetWitness Endpoint) All Supported Not Impacted Product does not use Apache Struts. 2017-09-12 eFraudNetwork (eFN) All Supported Not Impacted   2017-09-25 enVision EOPS Not Impacted Product does not use Apache Struts. 2017-09-11 Federated Identity Manager All Supported Not Impacted Product does not use impacted version of Apache Struts 2017-09-14 FraudAction (OTMS) All Supported Not Impacted   2017-09-25 Identity Governance and Lifecycle Software    (Via Lifecycle and Governance Software, Identity Management & Governance Software) All Supported Not Impacted Product does not use Apache Struts. 2017-09-21 Identity Governance and Lifecycle Appliance    (Via Lifecycle and Governance Appliance, Identity Management & Governance Appliance) All Supported Not Impacted Product does not use Apache Struts. 2017-09-21 Identity Governance and Lifecycle SaaS / MyAccessLive    (Via Lifecycle and Governance SaaS / MyAccessLive) All Supported Not Impacted Product does not use Apache Struts. 2017-09-21 NetWitness / Security Analytics    (Physical and Virtual Appliances) All Supported Not Impacted Product does not use Apache Struts. 2017-09-12 RSA Central All Supported Not Impacted Product does not use impacted version of Apache Struts 2017-09-15 RSA Live Infrastructure All Supported Not Impacted Product does not use Apache Struts. 2017-09-12 SecurID Access Cloud Service All Supported Not Impacted   2017-09-25 SecurID Access IDR VM All Supported Not Impacted   2017-09-25 SecurID Agent for PAM All Supported Not Impacted   2017-09-12 SecurID Agent for Web All Supported Not Impacted   2017-09-12 SecurID Agent for Windows All Supported Not Impacted   2017-09-12 SecurID Authentication Engine All Supported Not Impacted   2017-09-12 SecurID Authentication SDK All Supported Not Impacted   2017-09-12 SecurID Software Token Converter All Supported Not Impacted   2017-09-12 SecurID Software Token for Android All Supported Not Impacted   2017-09-12 SecurID Software Token for Blackberry All Supported Not Impacted   2017-09-12 SecurID Software Token for Desktop All Supported Not Impacted   2017-09-12 SecurID Software Token for iPhone All Supported Not Impacted   2017-09-12 SecurID Software Token for Windows Mobile All Supported Not Impacted   2017-09-12 SecurID Software Token Toolbar All Supported Not Impacted   2017-09-12 SecurID Software Token Web SDK All Supported Not Impacted   2017-09-12 SecurID Transaction Signing SDK All Supported Not Impacted   2017-09-12 Web Threat Detection All Supported Not Impacted Product does not use Apache Struts 2017-10-16
Notes	For status of Dell products, see: http://www.dell.com/support/article/us/en/19/sln307406/apache-struts-2-remote-code-execution-vulnerability--cve-2017-12611-?lang=en For status of Dell EMC products, see: https://support.emc.com/kb/504013 For status of Dell EMC CPSD products, see: http://support.vce.com/kA2A0000000LKm0

Disclaimer

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.