PT-2017-2098 · Apache · Apache Tomee

Cpnrodzc7 · Publicado 2017-04-11 · Atualizado 2018-10-09 · CVE-2016-0779

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache TomEE versions prior to 1.7.4 Apache TomEE versions 7.x prior to 7.0.0-M3

Description The issue is related to insufficient access control in the EjbObjectInputStream class of the Apache TomEE application server. It can be exploited by a remote attacker using a specially crafted serialized object to execute arbitrary code.

Recommendations For Apache TomEE versions prior to 1.7.4, update to version 1.7.4 or later. For Apache TomEE versions 7.x prior to 7.0.0-M3, update to version 7.0.0-M3 or later.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2017-01266

CVE-2016-0779

Produtos afetados

Apache Tomee

Referências · 10

• http://tomee.apache.org/security/tomee.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0779 · Nota de Segurança
• http://tomee-openejb.979440.n4.nabble.com/Document-resolved-vulnerability-CVE-2015-8581-td4678073.html · Nota
• https://bdu.fstec.ru/vul/2017-01266 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-15-638 · Nota
• http://securityfocus.com/archive/1/537806/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2016-0779 · Aviso do Fabricante
• http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html · Nota
• http://securityfocus.com/bid/79204 · Nota
• http://securityfocus.com/archive/1/archive/1/537806/100/0/threaded · Nota