Security Notification Apache Struts2-Global Version

Security Notification Apache Struts2-Global Version

Security Notification –Apache Struts2 Vulnerability Alert in CertainHikvision iVMS Platforms

SN No.:HSRC-201703-05

Edit: HikvisionSecurity Responding Center (HSRC)

Initial Release Date:2017-4-6

Descriptions:

Apache Struts 2 is one ofpopular development frameworks for Java Web applications. However, recently JakartaMultipart parser, a plug-in of Apache Struts 2, was found to have a vulnerabilityof remote code execution. Attackers may execute malicious remote source code bymodifying the Content-Type in HTTP request when uploading the files by suchplug-in. For more information, please refer to the official website of ApacheStruts2: https://struts.apache.org/docs/s2-045.html

Affected Products:

  • iVMS-5200 Professionalbaseline versions V3.3.4 and before, including Mobile and ANPR sub systems.

  • Blazer Pro v1.0 baselineversions

Solution:

Hikvision has published a hotfixto upgrade Apache Struts 2 to its latest version, Struts 2.3.32 and 2.5.10.1,which Apache Struts had officially released to fix the potential vulnerability.To implement the hotfix:

1.   Download the hotfix from Hikvision official website:

  • iVMS-5200 Professional,including Mobile and ANPR sub systems: Click Here
  • Blazer Pro v1.0: Click Here

2.   Copy the hotfix 5200P-ST&FJ-201703.exe to the desktop of the computer orthe Blazer Pro where the Central Management Server service of the iVMS softwareis running.

3.   Close the Service Manager by clicking the Exit button at the notificationarea.

                            

4.   Double click the hotfix to run it. The hotfix will check the running environment,stop the services of the iVMS software, replace the affected files and restartthe services. If you see the interface below, it means that the system has beenupgraded successfully and returned to normal status.

5.   Restart the Service Manager.

If you have any doubt about the upgrade procedure,please do not hesitate to contact Hikvision local support team or at support@hikvision.com.

Contact Us:

Should you have a security problem or concern,please contact Hikvision Security Response Center at hsrc@hikvision.com.

Hikvision.com uses strictly necessary cookies and related technologies to enable the website to function. With your consent, we would also like to use cookies to observe and analyse traffic levels and other metrics / show you targeted advertising / show you advertising on the basis of your location / tailor our website's content. For more information on cookie practices please refer to our cookie policy.

 

Contact Us
Hik-Partner Pro close
Hik-Partner Pro
Security Business Assistant. At Your Fingertips. Learn more
Hik-Partner Pro
Scan and download the app
Hik-Partner Pro
Hik-Partner Pro
back to top

Get a better browsing experience

You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.