Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml (revision 387127) +++ security/vuxml/vuln.xml (working copy) @@ -57,6 +57,53 @@ --> + + cassandra -- remote execution of arbitrary code + + + cassandra + 1.2.01.2.19 + + + cassandra2 + 2.0.02.0.14 + 2.1.02.1.4 + + + + +

Jake Luciani reports:

+
Under its default configuration, Cassandra binds an unauthenticated + JMX/RMI interface to all network interfaces. As RMI is an API for the + transport and remote execution of serialized Java, anyone with access + to this interface can execute arbitrary code as the running user.
+
Mitigation:
+
1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade + to a supported version of Cassandra, or manually configure encryption + and authentication of JMX, + (see https://wiki.apache.org/cassandra/JmxSecurity).
+
2.0.x users should upgrade to 2.0.14
+
2.1.x users should upgrade to 2.1.4
+
Alternately, users of any version not wishing to upgrade can + reconfigure JMX/RMI to enable encryption and authentication according + to https://wiki.apache.org/cassandra/JmxSecurityor + http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html
+
Credit:
+
This issue was discovered by Georgi Geshev of MWR InfoSecurity
+

+ + + + http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/ + CVE-2015-0225 + + + 2015-04-01 + 2015-05-23 + + + dnsmasq -- remotely exploitable buffer overflow in release candidate