This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Security Advisory Articles
- RSA Community
- :
- Support
- :
- Security Advisory Articles
- :
- Apache Struts 2 Freemarker Remote Code Execution Vulnerability (CVE-2017-12611) in RSA Products
-
Options
- Subscribe to RSS Feed
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Apache Struts 2 Freemarker Remote Code Execution Vulnerability (CVE-2017-12611) in RSA Products
Article Number
000035536
CVE ID
CVE-2017-12611
Applies To
RSA Product Set: All RSA Products
Article Summary
On September 7, 2017, Apache disclosed a vulnerability in Apache Struts2 that could allow an attacker to execute arbitrary commands remotely on affected systems by sending a specially crafted web request to the vulnerable application.
The details for this vulnerability can be found at https://struts.apache.org/docs/s2-053.html.
The details for this vulnerability can be found at https://struts.apache.org/docs/s2-053.html.
Resolution
RSA is aware of and investigating this issue to identify potential product impact. The level of impact may vary depending on the affected product. The following table contains the latest available impact information. This table will be updated as additional information becomes available.
| RSA Product Name | Versions | Impacted? | Details | Last Updated |
|---|---|---|---|---|
| 3D Secure / Adaptive Authentication eCommerce | All Supported | Not Impacted | 2017-09-25 | |
| Access Manager | 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2 | Impacted - Remediated | Refer to the security advisory ESA-2017-130 on RSA Link. Hotfixes 6.2.4.07, 6.2.3.08, 6.2.2.11, 6.2.1.10, and 6.2.0.24 with a fix for this issue, are available for RSA Access Manager 6.2.x. | 2017-10-17 |
| Adaptive Authentication Cloud | All Supported | Not Impacted | 2017-10-02 | |
| Adaptive Authentication Hosted | All Supported | Not Impacted | Product does not use impacted version of Apache Struts | 2017-09-15 |
| Adaptive Authentication On-Prem | 7.x | Not Impacted | 2017-09-22 | |
| Archer Hosted | N/A | Not Impacted | 2017-09-25 | |
| Archer Platform | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Archer SecOps | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Archer Vulnerability & Risk Manager (VRM) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Authentication Manager | 8.1, 8.1SP1, 8.2, 8.2SP1 | Not Impacted | 2017-09-12 | |
| Authentication Manager Appliance | 8.1, 8.1SP1, 8.2, 8.2SP1 | Not Impacted | 2017-09-12 | |
| BSAFE C Products: MES, Crypto-C ME, SSL-C | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-14 |
| BSAFE Java Products: Cert-J, Crypto-J, SSL-J | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-14 |
| Data Loss Prevention | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| Data Protection Manager | 3.5.2.5 and earlier | Impacted - Remediated | Refer to the security advisory ESA-2017-132 on RSA Link. RSA Data Protection Manager 3.5.2.6 with a fix for this issue is available. | 2017-10-20 |
| DCS: Certificate Manager | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| DCS: Validation Manager | All Supported | Not Impacted | Does not ship Freemarker Java Template Engine | 2017-09-11 |
| ECAT (NetWitness Endpoint) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| eFraudNetwork (eFN) | All Supported | Not Impacted | 2017-09-25 | |
| enVision | EOPS | Not Impacted | Product does not use Apache Struts. | 2017-09-11 |
| Federated Identity Manager | All Supported | Not Impacted | Product does not use impacted version of Apache Struts | 2017-09-14 |
| FraudAction (OTMS) | All Supported | Not Impacted | 2017-09-25 | |
| Identity Governance and Lifecycle Software (Via Lifecycle and Governance Software, Identity Management & Governance Software) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-21 |
| Identity Governance and Lifecycle Appliance (Via Lifecycle and Governance Appliance, Identity Management & Governance Appliance) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-21 |
| Identity Governance and Lifecycle SaaS / MyAccessLive (Via Lifecycle and Governance SaaS / MyAccessLive) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-21 |
| NetWitness / Security Analytics (Physical and Virtual Appliances) | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| RSA Central | All Supported | Not Impacted | Product does not use impacted version of Apache Struts | 2017-09-15 |
| RSA Live Infrastructure | All Supported | Not Impacted | Product does not use Apache Struts. | 2017-09-12 |
| SecurID Access Cloud Service | All Supported | Not Impacted | 2017-09-25 | |
| SecurID Access IDR VM | All Supported | Not Impacted | 2017-09-25 | |
| SecurID Agent for PAM | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Agent for Web | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Agent for Windows | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Authentication Engine | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Authentication SDK | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token Converter | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Android | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Blackberry | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Desktop | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for iPhone | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token for Windows Mobile | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token Toolbar | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Software Token Web SDK | All Supported | Not Impacted | 2017-09-12 | |
| SecurID Transaction Signing SDK | All Supported | Not Impacted | 2017-09-12 | |
| Web Threat Detection | All Supported | Not Impacted | Product does not use Apache Struts | 2017-10-16 |
Notes
For status of Dell products, see: http://www.dell.com/support/article/us/en/19/sln307406/apache-struts-2-remote-code-execution-vulnerability--cve-2017-12611-?lang=en
For status of Dell EMC products, see: https://support.emc.com/kb/504013
For status of Dell EMC CPSD products, see: http://support.vce.com/kA2A0000000LKm0
For status of Dell EMC products, see: https://support.emc.com/kb/504013
For status of Dell EMC CPSD products, see: http://support.vce.com/kA2A0000000LKm0
Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
No ratings
