Interstage Application Server, Interstage Apworks, Interstage Interaction Manager, Interstage Studio: Apache Commons Fileupload vulnerability causes Denial of Service (CVE-2016-3092). August 9th, 2016

Notes on using this web page

1. Description

Apache Commons Fileupload contains a vulnerability which causes Denial of Service.

Not all computers are exposed to the threat of the vulnerability even if the corresponding product is installed.
There is a possibility of this vulnerability affecting the computer in which the product is installed if Struts1 is enabled and used in a Web application.

This vulnerability exists when the web application can receive multipart requests.

For the solution, please refer to "3-3. Workaround".

2. Impact

This vulnerability allows a malicious user to exhaust the Web application's CPU resources. It may result in a DoS attack against the server.

3. Affected systems and corresponding action

3-1. Affected systems:

GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, AT compatible machine, PRIMEQUEST, SPARC Enterprise, Fujitsu SPARC Servers

3-2. Affected products and required patch

For the solution, please refer to "3-3. Workaround".

Note: Determining the affected product
Please confirm the version of the product by "Software manual" appended to the product.

3-3. Workaround

1. Restrict the permitted maximum size of HTTP request header values to 2048 by Interstage HTTP Server's LimitRequestFieldSize directive or by Interstage Java EE 6's buffer-size-bytes property.
2. Blocking multipart requests by WAFs(Web Application Firewall) or Interstage HTTP Server's RewriteCond directive if the web application does not need multipart requests.
3. Delete commons-fileupload.jar from CLASSPATH entries if the web application does not need multipart requests.
4. Get commons-fileupload-1.3.2.jar from Apache Software Foundation, and set it to CLASSPATH entries instead of the old commons-fileupload.jar. Moreover, get commons-io.jar from Apache Software Foundation, and add it to CLASSPATH entries if commons-io.jar does not exist in CLASSPATH entries.

4. Related information

• CVE-2016-3092
  Apache Commons FileUpload vulnerable to denial-of-service (DoS)
  
  • JVN: http://jvn.jp/en/jp/JVN89379547/index.html
  • CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092
• www-announce mailing list archives
  Apache Commons Fileupload information disclosure vulnerability(Apache Software Foundation Mail Archives)

5. Revision history

• August 9th, 2016 :
  • Update "3-2. Affected products and required patch".
  • Add workarounds to "3-3. Workaround".
• July 7th, 2016: Initial release