Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apache Struts Zero Day Not Fixed By Patch

Posted by samzenpus on from the protect-ya-neck dept.

Trailrunner7 (1100399) writes "The Apache Software Foundation released an advisory warning that a patch issued in March for a zero-day vulnerability in Apache Struts did not fully patch the bug in question. Officials said a new patch is in development and will be released likely within the next 72 hours, said Rene Gielen of the Apache Struts team. On March 2, a patch was made available for a ClassLoader vulnerability in Struts up to version 2.3.16.1. An attacker would be able to manipulate the ClassLoader via request parameters. Apache said the fix was insufficient to repair the vulnerability."

15 comments

  1. Of course, the warning is three days old by Anonymous Coward · · Score: 1

    So... the patch should be out any moment.

    1. Re:Of course, the warning is three days old by Anonymous Coward · · Score: 0

      Not sure if to mod funny or insightful since "sarcastic" isn't an option...

  2. Version 2.3.16.2 already out by Anonymous Coward · · Score: 0

    See http://struts.apache.org/announce.html

  3. Still on 1.2 by roman_mir · · Score: 0

    Still on Struts 1.2, updating the source code myself to add various missing functionality (various missing attributes that really make the job much easier in many cases). It's amazing how much more life you can squeeze out of that framework simply by extending it.

    --
    You can't handle the truth.
  4. All zero-day... by Ksevio · · Score: 1

    Isn't that the case for all zero-day exploits? If it were already patched then it wouldn't really fit the criteria.

  5. Gee... by ericloewe · · Score: 2

    Must they absolutely advertise their bugs before they're fixed? Nothing wrong with being open after it's been patched, but this is like "Hey, we tried to fix a bug and failed, so you can totally go check our non-fix to figure out how to exploit this!"

  6. Good thing... by Bill_the_Engineer · · Score: 4, Insightful

    Apache struts announced another general availability release that has the fix on April 24th.

    This is why you shouldn't read a blog post when the source material is just as easy to read.

    --
    These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
    1. Re:Good thing... by Anonymous Coward · · Score: 0

      But how else are these shitty bloggers going to drive up their page hits and revenue?

  7. What? There is still an Apache Struts? by hax4bux · · Score: 4, Funny

    How about that?

    1. Re: What? There is still an Apache Struts? by Anonymous Coward · · Score: 0

      Hahaha there we go. Best comment so far.

  8. Comment removed by account_deleted · · Score: 5, Insightful

    Comment removed based on user account deletion

  9. Why would they strut something like that? by jeffb+(2.718) · · Score: 1

    ...never mind.

  10. People still use struts? by Anonymous Coward · · Score: 0

    People are still using struts?

    I use it as one of my weedout questions when interviewing potential employers: "I see you're a struts shop, Nice talking with you, bye".

    Still trying to decide if its a step up or down from Tibco, I think marginally a step up.

    1. Re:People still use struts? by Anonymous Coward · · Score: 0

      These design decisions are usually bedded in older codebases that were designed around the MVC paradigm that Struts (and Spring MVC, and others) provide as a "simplification" layer over JSP and Servlets. And then people leaving their old employer to a new one, taking a functioning web application implementation with them, and why would they want to learn something new? These places still use Ant :p

  11. Re: What? There is still an Apache Struts? by Anonymous Coward · · Score: 0

    struts killed my love of programming. 20 years of loving my job disappeared into nowhere.