The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 6 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Aix 7 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Aix 7.1 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Aix 8 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Ibm Aix | — | Apply the fix or workaround for java_april2016_advisory | Nov 30, 2017 | Jun 3, 2016 |
| Ibm Java | — | Upgrade IBM Java to version 7.1.3.40Upgrade IBM Java to version 6.1.8.25Upgrade IBM Java to version 7.0.9.40Upgrade IBM Java to version 6.0.16.25Upgrade IBM Java to version 8.0.3.0 | Oct 5, 2018 | Jun 3, 2016 |
| Suse | — | Upgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-pluginUpgrade java-1_7_0-ibm-develUpgrade java-1_7_1-ibm-alsaUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_0-ibmUpgrade java-1_8_0-ibm-develUpgrade java-1_7_1-ibm-jdbcUpgrade java-1_8_0-ibm-pluginUpgrade java-1_7_1-ibm-develUpgrade java-1_7_1-ibm-pluginUpgrade java-1_8_0-ibm-alsaUpgrade java-1_7_1-ibmUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_7_0-ibm-alsaUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibmUpgrade java-1_6_0-ibm-fontsUpgrade java-1_8_0-ibm | May 13, 2016 | May 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub