Alfresco vulnerability - how to fix the problem ?

[benjamindupont]

Hi,
I'm currently using Alfresco CE 4.2.f, and I saw there is avulnerability on this version :
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9300
http://seclists.org/bugtraq/2014/Jul/72
My data are sensitive, and I want to prevent a disclosure, do you have an idea to fix or avoid this problem ?

According to this article, the proxy servlet is concerned by this vulnerability. Is it possible to disable this function ? If yes, do you know how ? If not, what can you advise ?

For information, moving to the last Alfresco 5.0 version is not option.

Thanks!

Best regards

[benjamindupont]

Hi Axel,
Thanks for your precisions about CMIS! Could you just tell us (If you know of course!), if this threat concern only a server which is placed with others servers (intranet) or not ?
Thanks!

[afaust]

The threat concerns any server in a networked environment. Only if the Alfresco server in question would be prevented from making any outbound HTTP(S) connection attempts would you avoid the "network / port scan" part of the vulnerability. And technically you can't restrict the file-level access to a level where you aren't still affected by the "file scan" part of the vulnerability.