Lucene search

K
nvd[email protected]NVD:CVE-2016-0376
HistoryJun 03, 2016 - 2:59 p.m.

CVE-2016-0376

2016-06-0314:59:02
web.nvd.nist.gov

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.071

Percentile

94.0%

The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

Affected configurations

NVD
Node
novellsuse_linux_enterprise_software_development_kitMatch11.0sp4
OR
novellsuse_linux_enterprise_software_development_kitMatch12.0
OR
novellsuse_linux_enterprise_software_development_kitMatch12.0sp1
OR
novellsuse_linux_enterprise_module_for_legacy_softwareMatch12
OR
novellsuse_linux_enterprise_serverMatch11.0sp2ltss
OR
novellsuse_linux_enterprise_serverMatch11.0sp3ltss
OR
novellsuse_linux_enterprise_serverMatch11.0sp4
OR
novellsuse_linux_enterprise_serverMatch12.0
OR
novellsuse_linux_enterprise_serverMatch12.0sp1
OR
novellsuse_managerMatch2.1
OR
novellsuse_manager_proxyMatch2.1
OR
novellsuse_openstack_cloudMatch5
Node
ibmjava_sdkRange6.0.0.06.0.16.25technology
OR
ibmjava_sdkRange6.1.0.06.1.8.25technology
OR
ibmjava_sdkRange7.0.0.07.0.9.40technology
OR
ibmjava_sdkRange7.1.0.07.1.3.40technology
OR
ibmjava_sdkRange8.0.0.08.0.3.0technology
Node
redhatsatelliteMatch5.6
OR
redhatsatelliteMatch5.7
OR
redhatenterprise_linux_desktopMatch5.0
OR
redhatenterprise_linux_desktopMatch6.0
OR
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_hpc_node_supplementaryMatch6.0
OR
redhatenterprise_linux_hpc_node_supplementaryMatch7.0
OR
redhatenterprise_linux_serverMatch6.0
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_server_eusMatch6.7
OR
redhatenterprise_linux_server_eusMatch7.2
OR
redhatenterprise_linux_server_eusMatch7.3
OR
redhatenterprise_linux_server_eusMatch7.4
OR
redhatenterprise_linux_server_eusMatch7.5
OR
redhatenterprise_linux_workstationMatch5.0
OR
redhatenterprise_linux_workstationMatch6.0
OR
redhatenterprise_linux_workstationMatch7.0

References

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.071

Percentile

94.0%