Bug 1508123 (CVE-2016-5003)

Summary: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bmcclain, dbhole, dblechte, dmoppert, dwalluck, eedri, hhorak, java-maint, java-sig-commits, jorton, krzysztof.daniel, mgoldboi, michal.skrivanek, mizdebsk, puntogil, sbonazzo, sherold, sisharma, sochotni, ssaha, vbellur, ykaul, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20160524,reported=20160524,source=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H,cwe=CWE-502,fedora-all/xmlrpc=affected,rhel-5/xmlrpc=wontfix,rhel-6/xmlrpc3=affected,rhel-7/xmlrpc=affected,rhev-m-3/xmlrpc=wontfix/impact=moderate,rhscl-3/rh-java-common-xmlrpc=affected,rhes-3/xmlrpc-common=wontfix/impact=low,jbds-8/xmlrpc=notaffected,jbds-10/xmlrpc=notaffected,fuse-6/camel=affected,fuse-7/camel=affected,fis-2/xmlrpc-common=affected,rhev-m-4/xmlrpc=affected/impact=moderate
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a <ex:serializable> element.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:30:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1508124, 1578873, 1578874, 1578875, 1578876, 1578877, 1578878, 1594618    
Bug Blocks: 1508328    

Description Pedro Sampaio 2017-10-31 20:35:45 UTC
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. 

References:

http://www.openwall.com/lists/oss-security/2016/07/12/5
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html

Comment 1 Pedro Sampaio 2017-10-31 20:36:27 UTC
Created xmlrpc tracking bugs for this issue:

Affects: fedora-all [bug 1508124]

Comment 6 Riccardo Schirone 2018-05-14 08:25:33 UTC
Mitigation:

Setting enabledForExtensions is false by default, thus <ex:serializable> elements are not automatically deserialized. However, if you have it enabled and you don't need any of the provided functions (https://ws.apache.org/xmlrpc/extensions.html) we suggest you disable it.

Comment 8 errata-xmlrpc 2018-05-31 16:38:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1779 https://access.redhat.com/errata/RHSA-2018:1779

Comment 9 errata-xmlrpc 2018-05-31 21:09:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1780 https://access.redhat.com/errata/RHSA-2018:1780

Comment 10 errata-xmlrpc 2018-06-04 10:48:42 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1784 https://access.redhat.com/errata/RHSA-2018:1784

Comment 11 Doran Moppert 2018-06-25 02:23:23 UTC
This vulnerability can also affect xmlrpc clients, if they may be used against untrusted servers.

Comment 13 errata-xmlrpc 2018-07-31 17:49:07 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:2317 https://access.redhat.com/errata/RHSA-2018:2317

Comment 14 errata-xmlrpc 2018-12-04 16:00:43 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.2

Via RHSA-2018:3768 https://access.redhat.com/errata/RHSA-2018:3768