Vulnerability CVE-2015-5254


Published: 2016-01-08   Modified: 2017-08-08

Description:
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Vendor: Apache
Product: Activemq 
Version:
5.9.1
5.9.0
5.8.0
5.7.0
5.6.0
5.5.1
5.5.0
5.4.3
5.4.1
5.4.0
5.3.2
5.3.1
5.3.0
5.2.0
5.12.1
5.12.0
5.11.2
5.11.1
5.11.0
5.10.2
5.10.1
5.10.0
5.1.0
5.0.0
Vendor: Fedoraproject
Product: Fedora 
Version: 23; 22;
Vendor: Redhat
Product: Openshift 
Version: 2.0;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.html
http://rhn.redhat.com/errata/RHSA-2016-0489.html
http://www.debian.org/security/2016/dsa-3524
http://www.openwall.com/lists/oss-security/2015/12/08/6
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
https://issues.apache.org/jira/browse/AMQ-6013

Related CVE
CVE-2015-3149
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
CVE-2015-5219
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
CVE-2015-5300
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option,...
CVE-2015-5195
ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
CVE-2015-5194
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
CVE-2015-3198
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
CVE-2016-6312
The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion, which allows remote authenticated users with access to the webdav rep...
CVE-2016-4996
discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain th...

Copyright 2017, cxsecurity.com