PT-2010-5017 · Red Hat · Jboss Drools+2

Marc Schoenefeld · Published 2010-12-30 · Updated 2022-05-17 · CVE-2010-3708

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform versions 4.3 before 4.3.0.CP09 Red Hat JBoss Enterprise SOA Platform versions 4.2 and 4.3

Description The serialization implementation in JBoss Drools supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

Recommendations For Red Hat JBoss Enterprise Application Platform versions 4.3 before 4.3.0.CP09, apply the fix from Drools 4.0.7 to patch the vulnerability. For Red Hat JBoss Enterprise SOA Platform versions 4.2 and 4.3, apply the fix from Drools 4.0.7 to patch the vulnerability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-3708

GHSA-QVQ6-CW53-RMWG

RHSA-2010:0937

RHSA-2010:0938

Affected Products

Jboss Drools

Red Hat Jboss Enterprise Application Platform

Red Hat Jboss Enterprise Soa Platform

References · 11

• http://redhat.com/support/errata/RHSA-2010-0938.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3708 · Security Note
• http://redhat.com/support/errata/RHSA-2010-0939.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0940.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0937.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvq6-cw53-rmwg · Vendor Advisory
• http://securitytracker.com/id?1024813 · Note
• https://web.archive.org/web/20111025030056/http://securitytracker.com/id?1024813 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3708 · Note
• https://issues.jboss.org/browse/SOA-2319 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=633859 · Note