Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
APP:VMWARE-SPRING-CLASSLOADER |
|---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
APP |
Keywords |
VMware SpringSource Spring Framework class.classloader Remote Code Execution |
Release Date |
2010/10/01 |
Update Number |
1784 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
APP: VMware SpringSource Spring Framework class.classloader Remote Code Execution
This signature detects attempts to exploit a known remote code execution vulnerability in VMware SpringSource. It is due to a design weakness in the Web application framework. A remote attacker can leverage this weakness by sending a crafted HTTP request to a target system. A successful attack results in arbitrary code execution.
Extended Description
Spring Framework is prone to a remote code-injection vulnerability. An attacker can exploit this issue to inject and execute arbitrary malicious Java code within the context of the affected application. Successful exploits will compromise the affected application and the underlying system; other attacks are also possible. Versions of Spring Framework prior to 3.03, 2.5.6.SEC02, and 2.5.7.SR01 are vulnerable.
Affected Products
- Apache_software_foundation geronimo 2.1
- Apache_software_foundation geronimo 2.1.1
- Apache_software_foundation geronimo 2.1.2
- Apache_software_foundation geronimo 2.1.3
- Apache_software_foundation geronimo 2.1.4
- Apache_software_foundation geronimo 2.1.5
- Red_hat jboss_web_framework_kit_for_rhel_4_as 5.0.0
- Red_hat jboss_web_framework_kit_for_rhel_4_es 5.0.0
- Red_hat jboss_web_framework_kit_for_rhel_5_server 1.0.0
- Springsource spring_framework 2.5.0.SEC01 (Community Releases)
- Springsource spring_framework 2.5.0 (Subscription Customers)
- Springsource spring_framework 2.5.1.SEC01 (Community Releases)
- Springsource spring_framework 2.5.1 (Subscription Customers)
- Springsource spring_framework 2.5.2.SEC01 (Community Releases)
- Springsource spring_framework 2.5.2 (Subscription Customers)
- Springsource spring_framework 2.5.3.SEC01 (Community Releases)
- Springsource spring_framework 2.5.3 (Subscription Customers)
- Springsource spring_framework 2.5.4.SEC01 (Community Releases)
- Springsource spring_framework 2.5.4 (Subscription Customers)
- Springsource spring_framework 2.5.5.SEC01 (Community Releases)
- Springsource spring_framework 2.5.5 (Subscription Customers)
- Springsource spring_framework 2.5.6.SEC01 (Community Releases)
- Springsource spring_framework 2.5.6 (Subscription Customers)
- Springsource spring_framework 2.5.7
- Springsource spring_framework 2.6.6.SEC01
- Springsource spring_framework 3.0.0
- Springsource spring_framework 3.0.1
- Springsource spring_framework 3.0.2
References
- BugTraq: 40954
- CVE: CVE-2010-1622
- URL: http://www.springsource.com/security/cve-2010-1622