Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability

Bugtraq ID:	100612
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-9804
Remote:	Yes
Local:	No
Published:	Sep 05 2017 12:00AM
Updated:	Sep 27 2017 03:00PM
Credit:	Adam Cazzolla , and Jonathan Bullock
Vulnerable:	Oracle Weblogic Server 10.3.6 0 Oracle Weblogic Server 12.2.1.3 Oracle Weblogic Server 12.2.1.2 Oracle Weblogic Server 12.2.1.1 Oracle Weblogic Server 12.2.1.0 Oracle Weblogic Server 12.1.3.0 Oracle Siebel Applications 7.1 Oracle Siebel Applications 6.2 Oracle Siebel Applications 16.1 Oracle MySQL Enterprise Monitor 3.2.1182 Oracle MySQL Enterprise Monitor 3.4.2.4181 Oracle MySQL Enterprise Monitor 3.4.1 Oracle MySQL Enterprise Monitor 3.4.0 Oracle MySQL Enterprise Monitor 3.3.4.3247 Oracle MySQL Enterprise Monitor 3.3.3.1199 Oracle MySQL Enterprise Monitor 3.3.2.1162 Oracle MySQL Enterprise Monitor 3.3.0.1098 Oracle MySQL Enterprise Monitor 3.2.8.2223 Oracle MySQL Enterprise Monitor 3.2.7.1204 Oracle MySQL Enterprise Monitor 3.2.5.1141 Oracle MySQL Enterprise Monitor 3.2.4.1102 Oracle MySQL Enterprise Monitor 3.2.1.1049 Oracle MICROS Retail XBRi Loss Prevention 10.8.1 Oracle MICROS Retail XBRi Loss Prevention 10.8 Oracle MICROS Retail XBRi Loss Prevention 10.7 Oracle MICROS Retail XBRi Loss Prevention 10.6 Oracle MICROS Retail XBRi Loss Prevention 10.5 Oracle MICROS Retail XBRi Loss Prevention 10.0.1 Oracle Insurance Performance Insight for General Insurance 8.0 Oracle Insurance Data Foundation 8.0.5 Oracle Insurance Data Foundation 8.0.4 Oracle Insurance Data Foundation 8.0.3 Oracle Insurance Data Foundation 8.0.2 Oracle Insurance Data Foundation 8.0.1 Oracle FLEXCUBE Private Banking 12.1 Oracle FLEXCUBE Private Banking 12.0.3 Oracle FLEXCUBE Private Banking 12.0.2 Oracle FLEXCUBE Private Banking 12.0.1 Oracle FLEXCUBE Private Banking 12.0 Oracle FLEXCUBE Private Banking 2.2 Oracle FLEXCUBE Private Banking 3.0 Oracle Financial Services Retail Performance Analytics 8.0.5 Oracle Financial Services Retail Performance Analytics 8.0.4 Oracle Financial Services Retail Performance Analytics 8.0.3 Oracle Financial Services Retail Performance Analytics 8.0.2 Oracle Financial Services Retail Performance Analytics 8.0.1 Oracle Financial Services Retail Performance Analytics 8.0 Oracle Financial Services Retail Customer Analytics 8.0.5 Oracle Financial Services Retail Customer Analytics 8.0.4 Oracle Financial Services Retail Customer Analytics 8.0.3 Oracle Financial Services Retail Customer Analytics 8.0.2 Oracle Financial Services Retail Customer Analytics 8.0.1 Oracle Financial Services Retail Customer Analytics 8.0 Oracle Financial Services Profitability Management 8.0.5 Oracle Financial Services Profitability Management 8.0.4 Oracle Financial Services Profitability Management 8.0.3 Oracle Financial Services Profitability Management 8.0.2 Oracle Financial Services Profitability Management 8.0.1 Oracle Financial Services Profitability Management 6.1.1 Oracle Financial Services Profitability Management 6.1 Oracle Financial Services Profitability Management 6.0 Oracle Financial Services Pricing Management 8.0.5 Oracle Financial Services Pricing Management 8.0.4 Oracle Financial Services Pricing Management 8.0 Oracle Financial Services Price Creation and Discovery 8.0.5 Oracle Financial Services Price Creation and Discovery 8.0.4 Oracle Financial Services Price Creation and Discovery 8.0 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.1 Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5.1 Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5 Oracle Financial Services Liquidity Risk Management 8.0.4 Oracle Financial Services Liquidity Risk Management 8.0.2 Oracle Financial Services Liquidity Risk Management 8.0.1 Oracle Financial Services Institutional Performance Analytics 8.0.5 Oracle Financial Services Institutional Performance Analytics 8.0.4 Oracle Financial Services Institutional Performance Analytics 8.0.3 Oracle Financial Services Institutional Performance Analytics 8.0.2 Oracle Financial Services Institutional Performance Analytics 8.0.1 Oracle Financial Services Institutional Performance Analytics 8.0 Oracle Financial Services ICAAP Analytics 8.0 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.3 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.2 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.1 Oracle Financial Services Hedge Management and IFRS Valuations 6.1.1 Oracle Financial Services Funds Transfer Pricing 8.0.5 Oracle Financial Services Funds Transfer Pricing 8.0.4 Oracle Financial Services Funds Transfer Pricing 8.0.3 Oracle Financial Services Funds Transfer Pricing 8.0.2 Oracle Financial Services Funds Transfer Pricing 8.0.1 Oracle Financial Services Funds Transfer Pricing 6.1.1 Oracle Financial Services Funds Transfer Pricing 6.1 Oracle Financial Services Funds Transfer Pricing 6.0 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.5 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.4 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.3 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.2 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.1 Oracle Financial Services Enterprise Financial Performance Analytics 8.0 Oracle Financial Services Data Integration Hub 8.0.4 Oracle Financial Services Data Integration Hub 8.0.3 Oracle Financial Services Data Integration Hub 8.0.2 Oracle Financial Services Data Integration Hub 8.0.1 Oracle Financial Services Data Foundation 8.0.5 Oracle Financial Services Data Foundation 8.0.4 Oracle Financial Services Data Foundation 8.0.3 Oracle Financial Services Data Foundation 8.0.2 Oracle Financial Services Data Foundation 8.0.1 Oracle Financial Services Data Foundation 7.4 Oracle Financial Services Data Foundation 7.3 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.4 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.3 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.2 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.1 Oracle Financial Services Basel Regulatory Capital Basic 8.0.4 Oracle Financial Services Basel Regulatory Capital Basic 8.0.3 Oracle Financial Services Basel Regulatory Capital Basic 8.0.2 Oracle Financial Services Basel Regulatory Capital Basic 8.0.1 Oracle Financial Services Asset Liability Management 8.0.5 Oracle Financial Services Asset Liability Management 8.0.4 Oracle Financial Services Asset Liability Management 8.0.3 Oracle Financial Services Asset Liability Management 8.0.2 Oracle Financial Services Asset Liability Management 8.0.1 Oracle Financial Services Asset Liability Management 6.1.1 Oracle Financial Services Asset Liability Management 6.1 Oracle Financial Services Asset Liability Management 6.0 Oracle Financial Services Analytical Applications Reconciliation 8.0.4 Oracle Financial Services Analytical Applications Reconciliation 8.0.3 Oracle Financial Services Analytical Applications Reconciliation 8.0.2 Oracle Financial Services Analytical Applications Reconciliation 8.0.1 Oracle Financial Services Analytical Applications Reconciliation 8.0 Oracle Financial Services Analytical Applications Reconciliation 3.5.1 Oracle Financial Services Analytical Applications Reconciliation 3.5 Oracle Financial Services Analytical Applications Infrastructure 7.3 Oracle Financial Services Analytical Applications Infrastructure 7.2 Oracle Communications Policy Management 12.1.1 Oracle Communications Policy Management 12.1 Oracle Communications Policy Management 11.5 Oracle Communications Policy Management 12.2 Cisco Video Distribution Suite for Internet Streaming (VDS-IS/CDS-IS) 0 Cisco Unified Intelligent Contact Management Enterprise 0 Cisco Unified Contact Center Enterprise 0 Cisco Network Performance Analysis 0 Cisco MXE 3500 Series Media Experience Engines 0 Cisco Hosted Collaboration Solution for Contact Center 0 Cisco Digital Media Manager (DMM) 0 Apache Struts 2.3.31 Apache Struts 2.3.30 Apache Struts 2.3.28 Apache Struts 2.3.24 Apache Struts 2.5.9 Apache Struts 2.5.8 Apache Struts 2.5.7 Apache Struts 2.5.6 Apache Struts 2.5.5 Apache Struts 2.5.4 Apache Struts 2.5.3 Apache Struts 2.5.2 Apache Struts 2.5.12 Apache Struts 2.5.11 Apache Struts 2.5.10.1 Apache Struts 2.5.10 Apache Struts 2.5.1 Apache Struts 2.5 Apache Struts 2.3.8 Apache Struts 2.3.7 Apache Struts 2.3.33 Apache Struts 2.3.32 Apache Struts 2.3.29 Apache Struts 2.3.28.1 Apache Struts 2.3.24.3 Apache Struts 2.3.24.2 Apache Struts 2.3.24.1 Apache Struts 2.3.20.3 Apache Struts 2.3.20.2 Apache Struts 2.3.20.1 Apache Struts 2.3.20 Apache Struts 2.3.16.3 Apache Struts 2.3.16.2 Apache Struts 2.3.16.1 Apache Struts 2.3.16 Apache Struts 2.3.15.3 Apache Struts 2.3.15.2 Apache Struts 2.3.15.1 Apache Struts 2.3.15 Apache Struts 2.3.14.3 Apache Struts 2.3.14.2 Apache Struts 2.3.14.1 Apache Struts 2.3.14
Not Vulnerable:	Apache Struts 2.5.13 Apache Struts 2.3.34

Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability

References:

• Apache Homepage (Apache Software Foundation)
  
• Struts Homepage (Apache Software Foundation)
  
• Bug 1488491 CVE-2017-9804 struts: A regular expression DoS when using URLValidat (Redhat)
  
• cisco-sa-20170907-struts2: Multiple Vulnerabilities in Apache Struts 2 Affecting (Cisco)
  
• CVE-2017-9804 (Redhat)
  
• Oracle Security Alert Advisory - CVE-2017-9805 (Oracle)
  
• Possible DoS attack when using URLValidator (Apache)