We know that criminals exploited a US website
application vulnerability.
The vulnerability was Apache Struts CVE-2017-5638
.
September 2017
Slide 10
Slide 10 text
https://nvd.nist.gov
Slide 11
Slide 11 text
The Jakarta Multipart parser in Apache Struts 2
2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has
incorrect exception handling and error-message
generation during
fi
le-upload
CVE-2017-5638
Slide 12
Slide 12 text
allows remote attackers to execute
arbitrary command
s
CVE-2017-5638
Slide 13
Slide 13 text
via a crafted Content-Type, Content-Disposition,
or Content-Length HTTP header, as exploited in
the wild in March 2017 with a Content-Type
header containing a #cmd= strin
g
CVE-2017-5638
Slide 14
Slide 14 text
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
Malicious payload in Content-Type header
security advic
e
from th
e
Apache Software Foundation
Slide 30
Slide 30 text
Understand which supporting frameworks and
libraries are used in your software products and
in which versions.
Keep track of security announcements affecting
this products and versions
.
apache.org — September 9, 2017
Slide 31
Slide 31 text
Establish a process to quickly roll out a security
fi
x release of your software product once
supporting frameworks or libraries needs to be
updated for security reasons
.
apache.org — September 9, 2017
Best is to think in terms of hours or a few days,
not weeks or months.
Slide 32
Slide 32 text
Any complex software contains
fl
aws.
Don't build your security policy on the
assumption that supporting software products
are
fl
awless
apache.org — September 9, 2017
Slide 33
Slide 33 text
Establish security layers
.
It is good software engineering practice to have
individually secured layers behind a public-
facing presentation layer such as the Apache
Struts framework.
apache.org — September 9, 2017
Slide 34
Slide 34 text
Establish monitoring for unusual access
patterns to your public web resources.
apache.org — September 9, 2017
Slide 35
Slide 35 text
Automatic patching?
Slide 36
Slide 36 text
I have talked to other software companies and people in
this space who say some companies have an automated
system that when a patch comes out it automatically gets
installed.
That is not what you had necessarily, right
?
Rep Greg Walde
n
October 3, 2017
Slide 37
Slide 37 text
I am unaware of an automatic patch
.
Richard Smit
h
former Equifax CE
O
October 3, 2017