Apache Struts 2 Freemarker Remote Code Execution Vulnerability (CVE-2017-12611) in RSA Products

Originally Published: 2017-09-11

Last Modified: 2023-10-06

Article Number

000067219

Applies To

RSA Product Set: All RSA Products

CVE Identifier(s)

CVE-2017-12611

Article Summary

On September 7, 2017, Apache disclosed a vulnerability in Apache Struts2 that could allow an attacker to execute arbitrary commands remotely on affected systems by sending a specially crafted web request to the vulnerable application.

The details for this vulnerability can be found at https://struts.apache.org/docs/s2-053.html.

Resolution

RSA is aware of and investigating this issue to identify potential product impact. The level of impact may vary depending on the affected product. The following table contains the latest available impact information. This table will be updated as additional information becomes available.

RSA Product Name	Versions	Impacted?	Details	Last Updated
3D Secure / Adaptive Authentication eCommerce	All Supported	Not Impacted		2017-09-25
Access Manager	6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2	Impacted - Remediated	Refer to the security advisory ESA-2017-130 on RSA Link. Hotfixes 6.2.4.07, 6.2.3.08, 6.2.2.11, 6.2.1.10, and 6.2.0.24 with a fix for this issue, are available for RSA Access Manager 6.2.x.	2017-10-17
Adaptive Authentication Cloud	All Supported	Not Impacted		2017-10-02
Adaptive Authentication Hosted	All Supported	Not Impacted	Product does not use impacted version of Apache Struts	2017-09-15
Adaptive Authentication On-Prem	7.x	Not Impacted		2017-09-22
Archer Hosted	N/A	Not Impacted		2017-09-25
Archer Platform	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-11
Archer SecOps	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-11
Archer Vulnerability & Risk Manager (VRM)	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-11
Authentication Manager	8.1, 8.1SP1, 8.2, 8.2SP1	Not Impacted		2017-09-12
Authentication Manager Appliance	8.1, 8.1SP1, 8.2, 8.2SP1	Not Impacted		2017-09-12
BSAFE C Products: MES, Crypto-C ME, SSL-C	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-14
BSAFE Java Products: Cert-J, Crypto-J, SSL-J	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-14
Data Loss Prevention	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-12
Data Protection Manager	3.5.2.5 and earlier	Impacted - Remediated	Refer to the security advisory ESA-2017-132 on RSA Link. RSA Data Protection Manager 3.5.2.6 with a fix for this issue is available.	2017-10-20
DCS: Certificate Manager	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-11
DCS: Validation Manager	All Supported	Not Impacted	Does not ship Freemarker Java Template Engine	2017-09-11
ECAT (NetWitness Endpoint)	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-12
eFraudNetwork (eFN)	All Supported	Not Impacted		2017-09-25
enVision	EOPS	Not Impacted	Product does not use Apache Struts.	2017-09-11
Federated Identity Manager	All Supported	Not Impacted	Product does not use impacted version of Apache Struts	2017-09-14
FraudAction (OTMS)	All Supported	Not Impacted		2017-09-25
Identity Governance and Lifecycle Software (Via Lifecycle and Governance Software, Identity Management & Governance Software)	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-21
Identity Governance and Lifecycle Appliance (Via Lifecycle and Governance Appliance, Identity Management & Governance Appliance)	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-21
Identity Governance and Lifecycle SaaS / MyAccessLive (Via Lifecycle and Governance SaaS / MyAccessLive)	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-21
NetWitness / Security Analytics (Physical and Virtual Appliances)	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-12
RSA Central	All Supported	Not Impacted	Product does not use impacted version of Apache Struts	2017-09-15
RSA Live Infrastructure	All Supported	Not Impacted	Product does not use Apache Struts.	2017-09-12
SecurID Access Cloud Service	All Supported	Not Impacted		2017-09-25
SecurID Access IDR VM	All Supported	Not Impacted		2017-09-25
SecurID Agent for PAM	All Supported	Not Impacted		2017-09-12
SecurID Agent for Web	All Supported	Not Impacted		2017-09-12
SecurID Agent for Windows	All Supported	Not Impacted		2017-09-12
SecurID Authentication Engine	All Supported	Not Impacted		2017-09-12
SecurID Authentication SDK	All Supported	Not Impacted		2017-09-12
SecurID Software Token Converter	All Supported	Not Impacted		2017-09-12
SecurID Software Token for Android	All Supported	Not Impacted		2017-09-12
SecurID Software Token for Blackberry	All Supported	Not Impacted		2017-09-12
SecurID Software Token for Desktop	All Supported	Not Impacted		2017-09-12
SecurID Software Token for iPhone	All Supported	Not Impacted		2017-09-12
SecurID Software Token for Windows Mobile	All Supported	Not Impacted		2017-09-12
SecurID Software Token Toolbar	All Supported	Not Impacted		2017-09-12
SecurID Software Token Web SDK	All Supported	Not Impacted		2017-09-12
SecurID Transaction Signing SDK	All Supported	Not Impacted		2017-09-12
Web Threat Detection	All Supported	Not Impacted	Product does not use Apache Struts	2017-10-16

Notes

For status of Dell products, see: http://www.dell.com/support/article/us/en/19/sln307406/apache-struts-2-remote-code-execution-vulnerability--cve-2017-12611-?lang=en
For status of Dell EMC products, see: https://support.emc.com/kb/504013
For status of Dell EMC CPSD products, see: http://support.vce.com/kA2A0000000LKm0

Disclaimer

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Don't see what you're looking for?

Salesforce MFA Enforcement – Action Required

Related Articles

Trending Articles