PT-2018-5302 · Oracle+2 · Java Rmi+2

Publicado 2018-07-25 · Atualizado 2018-10-02 · CVE-2017-10934

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE ZXIPTV-EPG versions prior to V5.09.02.02T4

Description The issue concerns the use of the Java RMI service with the Apache Commons Collections (ACC) library, which may lead to Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit this by sending a crafted RMI request, potentially allowing the execution of arbitrary code on the target host.

Recommendations For versions prior to V5.09.02.02T4, update to version V5.09.02.02T4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Java RMI service to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-10934

Produtos afetados

Apache Commons Collections

Java Rmi

Zte Zxiptv-Epg

Referências · 3

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008682 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-10934 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-10934 · Nota de Segurança