PT-2018-5045 · Apache+2 · Karaf+3

Jason Shepherd · Publicado 2018-08-01 · Atualizado 2023-02-12 · CVE-2016-8648

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Fuse versions 6.x Red Hat JBoss A-MQ versions 6.x

Description A flaw was discovered in the Karaf container used by Red Hat JBoss Fuse and Red Hat JBoss A-MQ, where it deserializes objects passed to MBeans via JMX operations. This could allow an attacker to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contains deserialization gadgets in its classpath.

Recommendations For Red Hat JBoss Fuse version 6.x, update to a version that includes a fix for this issue. For Red Hat JBoss A-MQ version 6.x, update to a version that includes a fix for this issue.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2016-8648

Produtos afetados

Java Virtual Machine

Karaf

Red Hat Jboss A-Mq

Red Hat Jboss Fuse

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8648 · Nota de Segurança
• http://securityfocus.com/bid/94513 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648 · Nota
• https://osv.dev/vulnerability/CVE-2016-8648 · Aviso do Fabricante