PT-2017-2098 · Apache · Apache Tomee

Cpnrodzc7 · Published 2017-04-11 · Updated 2018-10-09 · CVE-2016-0779

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache TomEE versions prior to 1.7.4 Apache TomEE versions 7.x prior to 7.0.0-M3

Description The issue is related to insufficient access control in the EjbObjectInputStream class of the Apache TomEE application server. It can be exploited by a remote attacker using a specially crafted serialized object to execute arbitrary code.

Recommendations For Apache TomEE versions prior to 1.7.4, update to version 1.7.4 or later. For Apache TomEE versions 7.x prior to 7.0.0-M3, update to version 7.0.0-M3 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2017-01266

CVE-2016-0779

Affected Products

Apache Tomee

References · 10

• http://tomee.apache.org/security/tomee.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0779 · Security Note
• https://bdu.fstec.ru/vul/2017-01266 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0779 · Vendor Advisory
• http://tomee-openejb.979440.n4.nabble.com/Document-resolved-vulnerability-CVE-2015-8581-td4678073.html · Note
• http://zerodayinitiative.com/advisories/ZDI-15-638 · Note
• http://securityfocus.com/archive/1/537806/100/0/threaded · Note
• http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html · Note
• http://securityfocus.com/bid/79204 · Note
• http://securityfocus.com/archive/1/archive/1/537806/100/0/threaded · Note