CVE-2017-3199

Published: Jun 11, 2018Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Affected (1)

Products: Graniteds: Graniteds

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Graniteds Graniteds	Version 3.1.1

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (8)

http://www.securityfocus.com/bid/97382

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution

Source: cret@cert.org

Third Party Advisory

https://codewhitesec.blogspot.com/2017/04/amf.html

Source: cret@cert.org

ExploitThird Party Advisory

https://www.kb.cert.org/vuls/id/307983

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/97382

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://codewhitesec.blogspot.com/2017/04/amf.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.kb.cert.org/vuls/id/307983

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.