PT-2010-5017 · Red Hat · Jboss Drools+2

Marc Schoenefeld · Publicado 2010-12-30 · Atualizado 2022-05-17 · CVE-2010-3708

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform versions 4.3 before 4.3.0.CP09 Red Hat JBoss Enterprise SOA Platform versions 4.2 and 4.3

Description The serialization implementation in JBoss Drools supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

Recommendations For Red Hat JBoss Enterprise Application Platform versions 4.3 before 4.3.0.CP09, apply the fix from Drools 4.0.7 to patch the vulnerability. For Red Hat JBoss Enterprise SOA Platform versions 4.2 and 4.3, apply the fix from Drools 4.0.7 to patch the vulnerability.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-3708

GHSA-QVQ6-CW53-RMWG

RHSA-2010:0937

RHSA-2010:0938

Produtos afetados

Jboss Drools

Red Hat Jboss Enterprise Application Platform

Red Hat Jboss Enterprise Soa Platform

Referências · 11

• http://redhat.com/support/errata/RHSA-2010-0938.html · Aviso do Fabricante
• http://securitytracker.com/id?1024813 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3708 · Nota de Segurança
• http://redhat.com/support/errata/RHSA-2010-0939.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2010-0940.html · Aviso do Fabricante
• https://web.archive.org/web/20111025030056/http://securitytracker.com/id?1024813 · Nota
• http://redhat.com/support/errata/RHSA-2010-0937.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3708 · Nota
• https://issues.jboss.org/browse/SOA-2319 · Nota
• https://osv.dev/vulnerability/GHSA-qvq6-cw53-rmwg · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=633859 · Nota