PT-2016-5930 · Apache+1 · Apache Commons Collections+2

Jacob Baines · Publicado 2016-09-21 · Atualizado 2018-02-17 · CVE-2016-4385

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP Network Automation Software versions 9.1x through 9.2x HP Network Automation Software versions 10.0x through 10.00.02.00 HP Network Automation Software versions 10.1x through 10.10.99.99

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections and Commons BeanUtils libraries. This is due to a deserialization of untrusted data vulnerability in the RMI service.

Recommendations For HP Network Automation Software versions 9.1x through 9.2x, update to version 10.00.02.01 or later. For HP Network Automation Software versions 10.0x through 10.00.02.00, update to version 10.00.02.01 or later. For HP Network Automation Software versions 10.1x through 10.10.99.99, update to version 10.11.00.01 or later.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2016-4385

ZDI-16-523

Produtos afetados

Apache Commons Beanutils

Apache Commons Collections

Hpe Network Automation

Referências · 7

• https://tenable.com/security/research/tra-2016-27 · Nota
• https://osv.dev/vulnerability/CVE-2016-4385 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-16-523 · Nota
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05279098 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4385 · Nota de Segurança
• http://securityfocus.com/bid/93109 · Nota
• https://zerodayinitiative.com/advisories/ZDI-16-523 · Nota de Segurança