Bug 1508123 (CVE-2016-5003) - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
Summary: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:se...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-5003
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1508124 1578873 1578874 1578875 1578876 1578877 1578878 1594618
Blocks: 1508328
TreeView+ depends on / blocked
 
Reported: 2017-10-31 20:35 UTC by Pedro Sampaio
Modified: 2021-09-09 12:46 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a <ex:serializable> element.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:30:11 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1779 0 None None None 2018-05-31 16:39:09 UTC
Red Hat Product Errata RHSA-2018:1780 0 None None None 2018-05-31 21:09:26 UTC
Red Hat Product Errata RHSA-2018:1784 0 None None None 2018-06-04 10:48:54 UTC
Red Hat Product Errata RHSA-2018:2317 0 None None None 2018-07-31 17:49:18 UTC
Red Hat Product Errata RHSA-2018:3768 0 None None None 2018-12-04 16:00:59 UTC

Description Pedro Sampaio 2017-10-31 20:35:45 UTC 
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. 

References:

http://www.openwall.com/lists/oss-security/2016/07/12/5
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
Comment 1 Pedro Sampaio 2017-10-31 20:36:27 UTC 
Created xmlrpc tracking bugs for this issue:

Affects: fedora-all [bug 1508124]
Comment 6 Riccardo Schirone 2018-05-14 08:25:33 UTC 
Mitigation:

Setting enabledForExtensions is false by default, thus <ex:serializable> elements are not automatically deserialized. However, if you have it enabled and you don't need any of the provided functions (https://ws.apache.org/xmlrpc/extensions.html) we suggest you disable it.
Comment 8 errata-xmlrpc 2018-05-31 16:38:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1779 https://access.redhat.com/errata/RHSA-2018:1779
Comment 9 errata-xmlrpc 2018-05-31 21:09:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1780 https://access.redhat.com/errata/RHSA-2018:1780
Comment 10 errata-xmlrpc 2018-06-04 10:48:42 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1784 https://access.redhat.com/errata/RHSA-2018:1784
Comment 11 Doran Moppert 2018-06-25 02:23:23 UTC 
This vulnerability can also affect xmlrpc clients, if they may be used against untrusted servers.
Comment 13 errata-xmlrpc 2018-07-31 17:49:07 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:2317 https://access.redhat.com/errata/RHSA-2018:2317
Comment 14 errata-xmlrpc 2018-12-04 16:00:43 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.2

Via RHSA-2018:3768 https://access.redhat.com/errata/RHSA-2018:3768
Comment 17 msiddiqu 2020-06-25 08:36:01 UTC 
Upstream Patch:
 
https://src.fedoraproject.org/rpms/xmlrpc/c/ef4efbf91d241070f6f41950f7536049688a3a67?branch=master
Note You need to log in before you can comment on or make changes to this bug.