Deserialization of untrusted data

2018-08-0114:29:00

PRIOn knowledge base

www.prio-n.com

7.8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.6%

JSON

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.

CPENameOperatorVersion
jboss_a-mqeq6.0.0
jboss_fuseeq6.0.0

CPE	Name	Operator	Version
	jboss_a-mq	eq	6.0.0
	jboss_fuse	eq	6.0.0

References

www.securityfocus.com/bid/94513

bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648