This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Security Advisory Articles
- RSA Community
- :
- Support
- :
- Security Advisory Articles
- :
- Apache Struts 2 Freemarker Remote Code Execution Vulnerability (CVE-2017-12611) in RSA Products
-
Options
- Subscribe to RSS Feed
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Apache Struts 2 Freemarker Remote Code Execution Vulnerability (CVE-2017-12611) in RSA Products
Article Number
000035536
CVE ID
000035536
Applies To
RSA Product Set: All RSA Products
Article Summary
On September 7, 2017, Apache disclosed a vulnerability in Apache Struts2 that could allow an attacker to execute arbitrary commands remotely on affected systems by sending a specially crafted web request to the vulnerable application.
The details for this vulnerability can be found at https://struts.apache.org/docs/s2-053.html.
The details for this vulnerability can be found at https://struts.apache.org/docs/s2-053.html.
Resolution
RSA is aware of and investigating this issue to identify potential product impact. The level of impact may vary depending on the affected product. The following table contains the latest available impact information. This table will be updated as additional information becomes available.
| RSA Product Name | Versions | Impacted? | Details | Last Updated |
|---|---|---|---|---|
| 3D Secure / Adaptive Authentication eCommerce | All Supported | Not Impacted | 2017-09-25 | |
| Access Manager | 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2 | Impacted - Remediated | Refer to the security advisory ESA-2017-130 on RSA Link. Hotfixes 6.2.4.07, 6.2.3.08, 6.2.2.11, 6.2.1.10, and 6.2.0.24 with a fix for this issue, are available for RSA Access Manager 6.2.x. | 2017-10-17 |
| Adaptive Authentication Cloud | All Supported | Not Impacted | 2017-10-02 | |
| Adaptive Authentication Hosted | All Supported | Not Impacted | Product does not use impacted version of Apache Struts | 2017-09-15 |
| Adaptive Authentication On-Prem | 7.x | Not Impacted | 2017-09-22 | |
| Archer Hosted | N/A | Not Impacted | 2017-09-25 | |
| Archer Platform | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Archer SecOps | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Archer Vulnerability & Risk Manager (VRM) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Authentication Manager | 8.1, 8.1SP1, 8.2, 8.2SP1 | Not Impacted | 2017-09-12 | |
| Authentication Manager Appliance | 8.1, 8.1SP1, 8.2, 8.2SP1 | Not Impacted | 2017-09-12 | |
| BSAFE C Products: MES, Crypto-C ME, SSL-C | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-14 |
| BSAFE Java Products: Cert-J, Crypto-J, SSL-J | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-14 |
| Data Loss Prevention | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| Data Protection Manager | 3.5.2.5 and earlier | Impacted - Remediated | Refer to the security advisory ESA-2017-132 on RSA Link. RSA Data Protection Manager 3.5.2.6 with a fix for this issue is available. | 2017-10-20 |
| DCS: Certificate Manager | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| DCS: Validation Manager | All Supported | Not Impacted | Does not ship Freemarker Java Template Engine | 2017-09-11 |
| ECAT (NetWitness Endpoint) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| eFraudNetwork (eFN) | All Supported | Not Impacted | 2017-09-25 | |
| enVision | EOPS | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Federated Identity Manager | All Supported | Not Impacted | Product does not use impacted version of Apache Struts | 2017-09-14 |
| FraudAction (OTMS) | All Supported | Not Impacted | 2017-09-25 | |
| Identity Governance and Lifecycle Software (Via Lifecycle and Governance Software, Identity Management & Governance Software) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-21 |
| Identity Governance and Lifecycle Appliance (Via Lifecycle and Governance Appliance, Identity Management & Governance Appliance) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-21 |
| Identity Governance and Lifecycle SaaS / MyAccessLive (Via Lifecycle and Governance SaaS / MyAccessLive) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-21 |
| NetWitness / Security Analytics (Physical and Virtual Appliances) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| RSA Central | All Supported | Not Impacted | Product does not use impacted version of Apache Struts | 2017-09-15 |
| RSA Live Infrastructure | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| SecurID Access Cloud Service | All Supported | Not Impacted | 2017-09-25 | |
| SecurID Access IDR VM | All Supported | Not Impacted | 2017-09-25 | |
| SecurID Agent for PAM | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Agent for Web | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Agent for Windows | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Authentication Engine | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Authentication SDK | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token Converter | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Android | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Blackberry | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Desktop | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for iPhone | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Windows Mobile | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token Toolbar | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token Web SDK | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Transaction Signing SDK | All Supported | Not Impacted | 2017-09-12 | |
| Web Threat Detection | All Supported | Not Impacted | Product does not use Apache Struts | 2017-10-16 |
Notes
For status of Dell products, see: http://www.dell.com/support/article/us/en/19/sln307406/apache-struts-2-remote-code-execution-vulnerability--cve-2017-12611-?lang=en
For status of Dell EMC products, see: https://support.emc.com/kb/504013
For status of Dell EMC CPSD products, see: http://support.vce.com/kA2A0000000LKm0
For status of Dell EMC products, see: https://support.emc.com/kb/504013
For status of Dell EMC CPSD products, see: http://support.vce.com/kA2A0000000LKm0
No ratings
