Apache Struts CVE-2017-9793 Denial of Service Vulnerability

Bugtraq ID:	100611
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-9793
Remote:	Yes
Local:	No
Published:	Sep 05 2017 12:00AM
Updated:	Sep 27 2017 03:00PM
Credit:	Huijun Chen, and Xiaolong Zhu
Vulnerable:	Oracle Weblogic Server 10.3.6 0 Oracle Weblogic Server 12.2.1.3 Oracle Weblogic Server 12.2.1.2 Oracle Weblogic Server 12.2.1.1 Oracle Weblogic Server 12.2.1.0 Oracle Weblogic Server 12.1.3.0 Oracle Siebel Applications 7.1 Oracle Siebel Applications 6.2 Oracle Siebel Applications 16.1 Oracle MySQL Enterprise Monitor 3.2.1182 Oracle MySQL Enterprise Monitor 3.4.2.4181 Oracle MySQL Enterprise Monitor 3.4.1 Oracle MySQL Enterprise Monitor 3.4.0 Oracle MySQL Enterprise Monitor 3.3.4.3247 Oracle MySQL Enterprise Monitor 3.3.3.1199 Oracle MySQL Enterprise Monitor 3.3.2.1162 Oracle MySQL Enterprise Monitor 3.3.0.1098 Oracle MySQL Enterprise Monitor 3.2.8.2223 Oracle MySQL Enterprise Monitor 3.2.7.1204 Oracle MySQL Enterprise Monitor 3.2.5.1141 Oracle MySQL Enterprise Monitor 3.2.4.1102 Oracle MySQL Enterprise Monitor 3.2.1.1049 Oracle MICROS Retail XBRi Loss Prevention 10.8.1 Oracle MICROS Retail XBRi Loss Prevention 10.8 Oracle MICROS Retail XBRi Loss Prevention 10.7 Oracle MICROS Retail XBRi Loss Prevention 10.6 Oracle MICROS Retail XBRi Loss Prevention 10.5 Oracle MICROS Retail XBRi Loss Prevention 10.0.1 Oracle Insurance Performance Insight for General Insurance 8.0 Oracle Insurance Data Foundation 8.0.5 Oracle Insurance Data Foundation 8.0.4 Oracle Insurance Data Foundation 8.0.3 Oracle Insurance Data Foundation 8.0.2 Oracle Insurance Data Foundation 8.0.1 Oracle FLEXCUBE Private Banking 12.1 Oracle FLEXCUBE Private Banking 12.0.3 Oracle FLEXCUBE Private Banking 12.0.2 Oracle FLEXCUBE Private Banking 12.0.1 Oracle FLEXCUBE Private Banking 12.0 Oracle FLEXCUBE Private Banking 2.2 Oracle FLEXCUBE Private Banking 3.0 Oracle Financial Services Retail Performance Analytics 8.0.5 Oracle Financial Services Retail Performance Analytics 8.0.4 Oracle Financial Services Retail Performance Analytics 8.0.3 Oracle Financial Services Retail Performance Analytics 8.0.2 Oracle Financial Services Retail Performance Analytics 8.0.1 Oracle Financial Services Retail Performance Analytics 8.0 Oracle Financial Services Retail Customer Analytics 8.0.5 Oracle Financial Services Retail Customer Analytics 8.0.4 Oracle Financial Services Retail Customer Analytics 8.0.3 Oracle Financial Services Retail Customer Analytics 8.0.2 Oracle Financial Services Retail Customer Analytics 8.0.1 Oracle Financial Services Retail Customer Analytics 8.0 Oracle Financial Services Profitability Management 8.0.5 Oracle Financial Services Profitability Management 8.0.4 Oracle Financial Services Profitability Management 8.0.3 Oracle Financial Services Profitability Management 8.0.2 Oracle Financial Services Profitability Management 8.0.1 Oracle Financial Services Profitability Management 6.1.1 Oracle Financial Services Profitability Management 6.1 Oracle Financial Services Profitability Management 6.0 Oracle Financial Services Pricing Management 8.0.5 Oracle Financial Services Pricing Management 8.0.4 Oracle Financial Services Pricing Management 8.0 Oracle Financial Services Price Creation and Discovery 8.0.5 Oracle Financial Services Price Creation and Discovery 8.0.4 Oracle Financial Services Price Creation and Discovery 8.0 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.1 Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5.1 Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5 Oracle Financial Services Liquidity Risk Management 8.0.4 Oracle Financial Services Liquidity Risk Management 8.0.2 Oracle Financial Services Liquidity Risk Management 8.0.1 Oracle Financial Services Institutional Performance Analytics 8.0.5 Oracle Financial Services Institutional Performance Analytics 8.0.4 Oracle Financial Services Institutional Performance Analytics 8.0.3 Oracle Financial Services Institutional Performance Analytics 8.0.2 Oracle Financial Services Institutional Performance Analytics 8.0.1 Oracle Financial Services Institutional Performance Analytics 8.0 Oracle Financial Services ICAAP Analytics 8.0 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.3 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.2 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.1 Oracle Financial Services Hedge Management and IFRS Valuations 6.1.1 Oracle Financial Services Funds Transfer Pricing 8.0.5 Oracle Financial Services Funds Transfer Pricing 8.0.4 Oracle Financial Services Funds Transfer Pricing 8.0.3 Oracle Financial Services Funds Transfer Pricing 8.0.2 Oracle Financial Services Funds Transfer Pricing 8.0.1 Oracle Financial Services Funds Transfer Pricing 6.1.1 Oracle Financial Services Funds Transfer Pricing 6.1 Oracle Financial Services Funds Transfer Pricing 6.0 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.5 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.4 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.3 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.2 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.1 Oracle Financial Services Enterprise Financial Performance Analytics 8.0 Oracle Financial Services Data Integration Hub 8.0.4 Oracle Financial Services Data Integration Hub 8.0.3 Oracle Financial Services Data Integration Hub 8.0.2 Oracle Financial Services Data Integration Hub 8.0.1 Oracle Financial Services Data Foundation 8.0.5 Oracle Financial Services Data Foundation 8.0.4 Oracle Financial Services Data Foundation 8.0.3 Oracle Financial Services Data Foundation 8.0.2 Oracle Financial Services Data Foundation 8.0.1 Oracle Financial Services Data Foundation 7.4 Oracle Financial Services Data Foundation 7.3 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.4 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.3 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.2 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.1 Oracle Financial Services Basel Regulatory Capital Basic 8.0.4 Oracle Financial Services Basel Regulatory Capital Basic 8.0.3 Oracle Financial Services Basel Regulatory Capital Basic 8.0.2 Oracle Financial Services Basel Regulatory Capital Basic 8.0.1 Oracle Financial Services Asset Liability Management 8.0.5 Oracle Financial Services Asset Liability Management 8.0.4 Oracle Financial Services Asset Liability Management 8.0.3 Oracle Financial Services Asset Liability Management 8.0.2 Oracle Financial Services Asset Liability Management 8.0.1 Oracle Financial Services Asset Liability Management 6.1.1 Oracle Financial Services Asset Liability Management 6.1 Oracle Financial Services Asset Liability Management 6.0 Oracle Financial Services Analytical Applications Reconciliation 8.0.4 Oracle Financial Services Analytical Applications Reconciliation 8.0.3 Oracle Financial Services Analytical Applications Reconciliation 8.0.2 Oracle Financial Services Analytical Applications Reconciliation 8.0.1 Oracle Financial Services Analytical Applications Reconciliation 8.0 Oracle Financial Services Analytical Applications Reconciliation 3.5.1 Oracle Financial Services Analytical Applications Reconciliation 3.5 Oracle Financial Services Analytical Applications Infrastructure 7.3 Oracle Financial Services Analytical Applications Infrastructure 7.2 Oracle Communications Policy Management 12.1.1 Oracle Communications Policy Management 12.1 Oracle Communications Policy Management 11.5 Oracle Communications Policy Management 12.2 Cisco Video Distribution Suite for Internet Streaming (VDS-IS/CDS-IS) 0 Cisco Unified Intelligent Contact Management Enterprise 0 Cisco Unified Contact Center Enterprise 0 Cisco Network Performance Analysis 0 Cisco MXE 3500 Series Media Experience Engines 0 Cisco Hosted Collaboration Solution for Contact Center 0 Cisco Digital Media Manager (DMM) 0 Apache Struts 2.3.31 Apache Struts 2.3.30 Apache Struts 2.3.28 Apache Struts 2.3.24 Apache Struts 2.5.9 Apache Struts 2.5.8 Apache Struts 2.5.7 Apache Struts 2.5.6 Apache Struts 2.5.5 Apache Struts 2.5.4 Apache Struts 2.5.3 Apache Struts 2.5.2 Apache Struts 2.5.12 Apache Struts 2.5.11 Apache Struts 2.5.10 Apache Struts 2.5.1 Apache Struts 2.5 Apache Struts 2.3.8 Apache Struts 2.3.7 Apache Struts 2.3.33 Apache Struts 2.3.32 Apache Struts 2.3.29 Apache Struts 2.3.28.1 Apache Struts 2.3.24.3 Apache Struts 2.3.24.2 Apache Struts 2.3.24.1 Apache Struts 2.3.20.3 Apache Struts 2.3.20.2 Apache Struts 2.3.20.1 Apache Struts 2.3.20 Apache Struts 2.3.16.3 Apache Struts 2.3.16.2 Apache Struts 2.3.16.1 Apache Struts 2.3.16 Apache Struts 2.3.15.3 Apache Struts 2.3.15.2 Apache Struts 2.3.15.1 Apache Struts 2.3.15 Apache Struts 2.3.14.3 Apache Struts 2.3.14.2 Apache Struts 2.3.14.1 Apache Struts 2.3.14
Not Vulnerable:	Apache Struts 2.5.13 Apache Struts 2.3.34

Apache Struts CVE-2017-9793 Denial of Service Vulnerability

Apache Struts is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users.

Apache Struts 2.3.7 through 2.3.33, and 2.5 through 2.5.12 are vulnerable.

Apache Struts CVE-2017-9793 Denial of Service Vulnerability

References:

• Apache Homepage (Apache Software Foundation)
  
• Struts Homepage (Apache Software Foundation)
  
• A DoS attack is possible when using outdated XStream library (Apache)
  
• cisco-sa-20170907-struts2: Multiple Vulnerabilities in Apache Struts 2 Affecting (Cisco)
  
• CVE-2017-9793 (Redhat)
  
• CVE-2017-9793 struts: DoS attack via crafted XML payload (Redhat)
  
• Oracle Security Alert Advisory - CVE-2017-9805 (Oracle)