Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:MISC:RED-HAT-JBOSS-CE |
|---|---|
Severity |
Critical |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Red Hat JBoss Application Server doFilter Insecure Deserialization |
Release Date |
2017/12/11 |
Update Number |
3016 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Red Hat JBoss Application Server doFilter Insecure Deserialization
An insecure deserialization vulnerability has been reported in Red Hat JBoss Application Server.A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted serialized object.Successful exploitation can result in arbitrary code execution in the security context of the SYSTEM/root user.
Extended Description
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
Affected Products
- Redhat jboss_enterprise_application_platform 5.0.0
- Redhat jboss_enterprise_application_platform 5.0.1
- Redhat jboss_enterprise_application_platform 5.1.0
- Redhat jboss_enterprise_application_platform 5.1.1
- Redhat jboss_enterprise_application_platform 5.1.2
- Redhat jboss_enterprise_application_platform 5.2.0
- Redhat jboss_enterprise_application_platform 5.2.1
- Redhat jboss_enterprise_application_platform 5.2.2
References
- BugTraq: 100591
- CVE: CVE-2017-12149