Slashdot Mirror
Backdoor Discovered In Atlassian Crowd
An anonymous reader writes "Recently published on the Command Five website is a technically detailed threat advisory (PDF) in relation to a recurring vulnerability in Atlassian Crowd. Tucked away inconspicuously at the end of this document in a section entitled 'Unpatched Vulnerabilities' is the real security bombshell: Atlassian's turnkey solution for enterprise single sign-on and secure user authentication contains an unpatched backdoor. The backdoor allows anyone to remotely take full control of a Crowd server and, according to Command Five, successful exploitation 'invariably' results in compromise of all application and user credentials as well as accessible data storage, configured directories (for example Active Directory), and dependent systems."
What is Atlassian Crowd, where is it used, how does this effect me, why should I care?
Did I miss any important questions?
[Fuck Beta]
o0t!
Atlassian has absolute contempt for their paying customers. Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users. JIRA and Crucible use some monstrosity of JavaScript that causes lag when typing into intput fields, and certain versions clash with Ghostery in a way that causes certain characters (e.g. spaces) to be swallowed. It's sad, but it doesn't surprise me at all that they don't care about security in an authentication system.
with it too without you meddling NSA kids being unable to catch snowden!
use cas and it's jasig developed altlassian plugin, Crowd is shit.
https://jira.atlassian.com/browse/CWD-3366
While it is nice for the persons in charge of this obscure software to be notified about a problem on Slashdot, I am not sure I would be very happy to see that generalized.
But that leads to a real question: how do you learn about vulnerabilities for the softwares you are in charge?
Unless it starts to really, really hurt selling this kind of trash, not fixing _known_ vulnerabilities and not using secure coding practices, nothing will change. It is just cheaper this way and most customers do not care or cannot do anything anyways. One reason surely is managers at the customers that made this broken decision or supported it and now cannot back out without hurting themselves. Another is that absolutely nothing is going to happen to the vendor legally.
Unless we start to require sound secure software engineering practices OR ELSE! nothing will change.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Today I learned about Atlassian, a company whose software I will never use.
The NSA has pretty much proven to me that the INTERNET is an "un-patched vulnerability..."
ATLAS SHRUGS at your weak, pathetic, concerns.
This is the Internet, Waffletwat!
I tried really hard to like Atlassian's products. Jira is okay. Confluence, on the other hand, turned me off to all Atlassian products. The interface is awful, and it is slower than molasses. I have no idea how anyone evaluates that product and thinks, "Yeah, this looks great and is snappy. This will work wonderfully!"
I think Atlassian is more interested in putting on dog shows than writing quality software.
space aliens in a group?
The original report says about the last vulnerability discussed (but not disclosed)
Indicators such as covert positioning, the use of special parameters, absence of log messages, facilitation of persistence, and apparent lack of legitimate purpose suggest that this vulnerability could be classified as a symmetric backdoor if malicious intent were to be established (which it has not).
I like the tone: they stop short of stating this is a deliberate backdoor of the worst kind, but give extremely convincing argument that it is one.
I've been treated at my $company to some Atlassian products (Jira, Confluence).
From my POV, it's just your "enterprise level Java hairball" (in marketing talk a "stack", perhaps because it sounds a bit more orderly) rendering a sad and bureaucratic caricature of things which already are around, like wiki and issue tracker. Crowd seems to be some single-sign-on thingie (think Kerberos and Moonshot, but perhaps pounded into a buzzword compliant but barely usable minceball).
there is no spoon
there is no spoon
shakes head YES THERE IS....
i dont live in da matrix
Appropriately enough, they are looking to hire a "Director of Security" in their Sydney office.
https://www.atlassian.com/company/careers/jobs/listing?org=ATLASSIAN&cws=1&rid=688
(Actually, Atlassian make some really good software and it would be a great place to work.)
Your attitude is infectious...
Perhaps if they found some to hire, this slashdot story might never have appeared? http://www.smh.com.au/it-pro/business-it/desperate-search-for-geniuses-goes-to-ends-of-the-earth-20130317-2g8rp.html/
Seriously, it takes about 10 minutes to get an installation up and running. Even for small networks it makes sense these days.
Just fyi for all this puzzlement. I have an atlassian jira, confluence and crowd install that I setup for a customer. The reason we chose crowd was to help drive adoption for the system, as it made the browser login only needed once to access either product. My only complaint at the time was the annoyance of dealing with license seats, but it otherwise worked as advertised without much effort to set up.
From the PDF, first footnote
Atlassian did not remove the original database from their servers during the migration. The original database contained unencrypted (plainÂtext) customer credentials and was successfully exfiltrated by hackers in April 2010, likely resulting in the compromise of multiple customer accounts. (Erdos, 2013)
That sucks...
Having read TFA, I don't *think* the embedded version of Crowd used for LDAP/AD authentication in JIRA since 5.x is effected by this, but it doesn't explicitly say it isn't. Anybody know for certain?