The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 6 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Aix 7 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Aix 7.1 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Aix 8 Java_april2016_advisory | — | — | Dec 19, 2016 | Jun 3, 2016 |
| Ibm Aix | — | Apply the fix or workaround for java_april2016_advisory | Nov 30, 2017 | Jun 3, 2016 |
| Ibm Java | — | Upgrade IBM Java to version 7.1.3.40Upgrade IBM Java to version 7.0.9.40Upgrade IBM Java to version 8.0.3.0Upgrade IBM Java to version 6.0.16.25Upgrade IBM Java to version 6.1.8.25 | Oct 5, 2018 | Jun 3, 2016 |
| Suse | — | Upgrade java-1_6_0-ibm-pluginUpgrade java-1_7_1-ibm-alsaUpgrade java-1_6_0-ibm-alsaUpgrade java-1_7_1-ibm-jdbcUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_0-ibmUpgrade java-1_7_1-ibm-develUpgrade java-1_8_0-ibm-pluginUpgrade java-1_7_1-ibm-pluginUpgrade java-1_7_0-ibm-develUpgrade java-1_8_0-ibm-develUpgrade java-1_7_1-ibmUpgrade java-1_6_0-ibm-fontsUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_8_0-ibm-alsaUpgrade java-1_8_0-ibmUpgrade java-1_7_0-ibm-alsaUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_6_0-ibmUpgrade java-1_6_0-ibm-devel | May 13, 2016 | May 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub