CVE-2016-8648

Published: Aug 1, 2018Modified: Nov 21, 2024

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.

Affected (2)

Products: Redhat: Jboss A Mq, Jboss Fuse

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss A Mq	Version 6.0.0
Redhat Jboss Fuse	Version 6.0.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

http://www.securityfocus.com/bid/94513

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648

Source: secalert@redhat.com

Issue TrackingMitigationThird Party Advisory

http://www.securityfocus.com/bid/94513

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationThird Party Advisory

Timeline

No history available yet.