OpenNMS 14.0.3 Released - SECURITY UPDATE CVE-2015-0975

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

OpenNMS 14.0.3 is out.  Among the usual bug fixes and minor
enhancements, it fixes a vulnerability in RTC which can provide remote
access to system data.  Details are available here:
http://www.opennms.org/wiki/CVE-2015-0975and the full disclosure is as
follows:

== CVE-2015-0975==

All OpenNMS versions prior to 14.0.3 have been found vulnerable to an
XXE attack, which can provide access to local filesystem data.

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2015-0975 to this issue. This is an entry on the CVE list
(http://cve.mitre.org), which standardizes names for security problems.

== Background ==

OpenNMS uses Castor for XML processing in RTC, the daemon responsible
for tracking node/interface/service availability. Due to historical
details of how RTC's data is displayed in the web UI, it would POST
status data to a servlet using a username and password of "rtc".  While
this password was meant to be configurable, the default username was
rarely (if ever) changed in user installations, and due to bit rot it
appears to no longer work in modern OpenNMS installations.


Castor is vulnerable to an XXE attack which can expose external entities
in exception messages (CVE-2014-3004) and the RTC POST servlet exposes
those exceptions upon error.  It is possible for attackers to craft an
RTC post which can reveal the contents of system files outside of OpenNMS.

== Required Actions ==

=== Recommended: Upgrade to 14.0.3 ===

It is *strongly* recommended that all users of OpenNMS upgrade to
OpenNMS 14.0.3 (or later, if available).

=== OpenNMS 1.12 or Higher: Alter the Spring Security Configuration ===

If you cannot immediately upgrade, you should change the Spring Security
context on OpenNMS 1.12 or higher by editing or replacing
$OPENNMS_HOME/jetty-webapps/opennms/WEB-INF/applicationContext-spring-security.xml,
changing the "OpenNMS Realm" <http> section to use expressions which
limit the IP address.

Sample replacements for the default spring security configuration files
for OpenNMS 1.12.x and 14.x are available for download
http://www.opennms.org/security/CVE-2015-0975/  These sample files limit
RTC POST access to connections from 127.0.0.1:

    <http pattern="/**" access-denied-page="/accessDenied.jsp"
realm="OpenNMS Realm" use-expressions="true">
        ...
        <intercept-url pattern="/rtc/post/**"
access="hasRole('ROLE_RTC') and hasIpAddress('127.0.0.1/32')"/>


- -- 
Benjamin Reed
The OpenNMS Group
http://www.opennms.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)

iD8DBQFUtVDOUu+jZtP2Zf4RAkPJAKCVJ5AXgjLrBd+v9Rfi7ee2qglokgCdFeEk
Jscr547dZhZATQghLbum7O8=
=Ic1d
-----END PGP SIGNATURE-----



------------------------------------------------------------------------------
New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
GigeNET is offering a free month of service with a new server in Ashburn.
Choose from 2 high performing configs, both with 100TB of bandwidth.
Higher redundancy.Lower latency.Increased capacity.Completely compliant.
http://p.sf.net/sfu/gigenet
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq

opennms-announce mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-announce