[SA19493] Struts Multiple Vulnerabilities

TITLE:
Struts Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA19493

VERIFY ADVISORY:
http://secunia.com/advisories/19493/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, Cross Site Scripting, DoS

WHERE:
>From remote

SOFTWARE:
Apache Struts 1.2.x
http://secunia.com/product/6179/

DESCRIPTION:
Some vulnerabilities have been reported in Struts, which can be
exploited by malicious people to conduct cross-site scripting
attacks, cause a DoS (Denial of Service), or bypass certain security
restrictions.

1) The RequestProcessor allows all actions to be canceled making it
possible to bypass validation in actions that proceed without
checking "isCancelled()". This may allow bypassing of security
restrictions.

2) The public method "getMultipartRequestHandler()" in ActionForm
gives access to elements in CommonsMultipartRequestHandler and
BeanUtils. This can be exploited to cause a DoS by sending a
specially request with a parameter referencing the public method.

3) Invalid input is not properly sanitised in LookupDispatchAction
when not corresponding to an entry in the lookupMap before being
returned to users in an error message. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of a vulnerable site.

SOLUTION:
Update to version 1.2.9 or later.
http://struts.apache.org/

PROVIDED AND/OR DISCOVERED BY:
1) Paul Benedict
2) Bogdan Serban
3) Tommy Wareing

ORIGINAL ADVISORY:
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
http://issues.apache.org/bugzilla/show_bug.cgi?id=38374
http://issues.apache.org/bugzilla/show_bug.cgi?id=38534
http://issues.apache.org/bugzilla/show_bug.cgi?id=38749

---

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.