CVE-2016-8648

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/94513	VDB Entry Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648	Mitigation Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::*
	cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*

History

12 Feb 2023, 23:26

Type	Values Removed	Values Added
References	~~(CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648 - Issue Tracking, Mitigation, Third Party Advisory~~	(CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648 - Mitigation, Issue Tracking, Third Party Advisory
References	~~(BID) http://www.securityfocus.com/bid/94513 - Third Party Advisory, VDB Entry~~	(BID) http://www.securityfocus.com/bid/94513 - VDB Entry, Third Party Advisory

Information

Published : 2018-08-01 14:29

Updated : 2023-12-10 12:44

NVD link : CVE-2016-8648

Mitre link : CVE-2016-8648

CVE.ORG link : CVE-2016-8648

JSON object : View

Products Affected

redhat

jboss_fuse
jboss_a-mq

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2016-8648", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2018-08-01T14:29:00.300", "references": [{"url": "http://www.securityfocus.com/bid/94513", "tags": ["VDB Entry", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648", "tags": ["Mitigation", "Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath."}, {"lang": "es", "value": "Se ha detectado que el contenedor Karaf empleado por Red Hat JBoss Fuse 6.x y Red Hat JBoss A-MQ 6.x deserializa los objetos que se pasan a MBeans mediante operaciones JMX. Un atacante podr\u00eda emplear este error para ejecutar c\u00f3digo remoto en el servidor como el usuario que ejecuta la m\u00e1quina virtual de Java si el MBean objetivo contiene gadgets de deserializaci\u00f3n en su ruta de clase."}], "lastModified": "2023-02-12T23:26:28.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33C4404A-CFB7-4B47-9487-F998825C31CA"}, {"criteria": "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A305F012-544E-4245-9D69-1C8CD37748B1"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}