From $URL: Versions of Metasploit Pro, Express, and Community editions before 4.14.0 (Update 2017061301) are vulnerable to CVE-2017-5244, regardless of operating system. Remediation We strongly encourage Metasploit users to update their instances to the latest version (Metasploit 4.14.0 (Update 2017061301) or above). You can find detailed update steps here. Release notes and offline installers are available here. Disclosure Timeline Sat, May 27, 2017: Vulnerability reported to Rapid7 by Mohamed A. Baset Tue, May 30, 2017: Vulnerability confirmed by Rapid7 Fri, June 9, 2017: Vulnerability fixed by Rapid7 Sun, June 11, 2017: Rapid7 assigned CVE-2017-5244 to this vulnerability Wed, June 14, 2017: Rapid7 released patch; public disclosure Wed, June 14, 2017: Rapid7 reported vulnerability to MITRE
Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself. Since this is now an security matter we are taking care of bug 620308 from here. Thanks, Gentoo Security Padawan ChrisADR
Gentoo does not provide web ui and likely not affected by this vulnerability. Feel free to double check that.
(In reply to Anton Bolshakov from comment #2) > Gentoo does not provide web ui and likely not affected by this vulnerability. > Feel free to double check that. Hi Anton, Besides the fact that Gentoo doesn't provide a web ui for Metasploit, the original report from Rapid7 says that the problem is that GET requests don't go through normal Rails anti-CSRF verification. There is more than one way to send a GET request to a service, like curl for example. Which means that this could possibly affect versions prior to 4.14.0 (Update 2017061301). We are just reporting the issue, but if the maintainer considers that this issue doesn't affect Gentoo in any way he can change the Status at any time. Thanks, Gentoo Security Padawan ChrisADR
The vulnerable files are not ge(In reply to Christopher Díaz from comment #3) > There is more than one way to send a GET request to a service, like curl for > example. Which means that this could possibly affect versions prior to > 4.14.0 (Update 2017061301). My point is that vulnerable files are not installed and there are no "stop and stop_all (task) routes" as per report. So there is nothing to exploit (using curl or not). However, it is time to bump msf anyway.
@maintainter(s): After version bump please notify security team if ready to stabilize.
