Bug 1508123 (CVE-2016-5003) - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
Summary: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:se...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-5003
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1508124 1578873 1578874 1578875 1578876 1578877 1578878 1594618
Blocks: 1508328
TreeView+ depends on / blocked
 
Reported: 2017-10-31 20:35 UTC by Pedro Sampaio
Modified: 2019-09-29 14:24 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a <ex:serializable> element.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:30:11 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1779 None None None 2018-05-31 16:39:09 UTC
Red Hat Product Errata RHSA-2018:1780 None None None 2018-05-31 21:09:26 UTC
Red Hat Product Errata RHSA-2018:1784 None None None 2018-06-04 10:48:54 UTC
Red Hat Product Errata RHSA-2018:2317 None None None 2018-07-31 17:49:18 UTC
Red Hat Product Errata RHSA-2018:3768 None None None 2018-12-04 16:00:59 UTC

Description Pedro Sampaio 2017-10-31 20:35:45 UTC
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. 

References:

http://www.openwall.com/lists/oss-security/2016/07/12/5
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html

Comment 1 Pedro Sampaio 2017-10-31 20:36:27 UTC
Created xmlrpc tracking bugs for this issue:

Affects: fedora-all [bug 1508124]

Comment 6 Riccardo Schirone 2018-05-14 08:25:33 UTC
Mitigation:

Setting enabledForExtensions is false by default, thus <ex:serializable> elements are not automatically deserialized. However, if you have it enabled and you don't need any of the provided functions (https://ws.apache.org/xmlrpc/extensions.html) we suggest you disable it.

Comment 8 errata-xmlrpc 2018-05-31 16:38:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1779 https://access.redhat.com/errata/RHSA-2018:1779

Comment 9 errata-xmlrpc 2018-05-31 21:09:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1780 https://access.redhat.com/errata/RHSA-2018:1780

Comment 10 errata-xmlrpc 2018-06-04 10:48:42 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1784 https://access.redhat.com/errata/RHSA-2018:1784

Comment 11 Doran Moppert 2018-06-25 02:23:23 UTC
This vulnerability can also affect xmlrpc clients, if they may be used against untrusted servers.

Comment 13 errata-xmlrpc 2018-07-31 17:49:07 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:2317 https://access.redhat.com/errata/RHSA-2018:2317

Comment 14 errata-xmlrpc 2018-12-04 16:00:43 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.2

Via RHSA-2018:3768 https://access.redhat.com/errata/RHSA-2018:3768


Note You need to log in before you can comment on or make changes to this bug.