PT-2016-5930 · Apache+1 · Apache Commons Collections+2

Jacob Baines · Published 2016-09-21 · Updated 2018-02-17 · CVE-2016-4385

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP Network Automation Software versions 9.1x through 9.2x HP Network Automation Software versions 10.0x through 10.00.02.00 HP Network Automation Software versions 10.1x through 10.10.99.99

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections and Commons BeanUtils libraries. This is due to a deserialization of untrusted data vulnerability in the RMI service.

Recommendations For HP Network Automation Software versions 9.1x through 9.2x, update to version 10.00.02.01 or later. For HP Network Automation Software versions 10.0x through 10.00.02.00, update to version 10.00.02.01 or later. For HP Network Automation Software versions 10.1x through 10.10.99.99, update to version 10.11.00.01 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2016-4385

ZDI-16-523

Affected Products

Apache Commons Beanutils

Apache Commons Collections

Hpe Network Automation

References · 7

• https://osv.dev/vulnerability/CVE-2016-4385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4385 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-523 · Security Note
• https://tenable.com/security/research/tra-2016-27 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-523 · Note
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05279098 · Note
• http://securityfocus.com/bid/93109 · Note