ID CVE-2016-4978
Summary The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:activemq_artemis:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:activemq_artemis:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_artemis:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:activemq_artemis:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_artemis:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:activemq_artemis:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_artemis:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:activemq_artemis:1.3.0:*:*:*:*:*:*:*
CVSS
Base: 6.0 (as of 29-05-2019 - 22:29)
Impact:
Exploitability:
CWE CWE-502
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
assigner via4 cve@mitre.org
cvss-vector via4 AV:N/AC:M/Au:S/C:P/I:P/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2017:1834
  • rhsa
    id RHSA-2017:1835
  • rhsa
    id RHSA-2017:1836
  • rhsa
    id RHSA-2017:1837
  • rhsa
    id RHSA-2017:3454
  • rhsa
    id RHSA-2017:3455
  • rhsa
    id RHSA-2017:3456
  • rhsa
    id RHSA-2017:3458
  • rhsa
    id RHSA-2018:1447
  • rhsa
    id RHSA-2018:1448
  • rhsa
    id RHSA-2018:1449
  • rhsa
    id RHSA-2018:1450
  • rhsa
    id RHSA-2018:1451
refmap via4
bid 93142
misc https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf
mlist
  • [activemq-issues] 20190529 [jira] [Closed] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978
  • [activemq-issues] 20190529 [jira] [Created] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978
  • [activemq-users] 20160923 [CVE-2016-4978] Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability
vulnerable_product via4
  • cpe:2.3:a:apache:activemq_artemis:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_artemis:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_artemis:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:activemq_artemis:1.3.0:*:*:*:*:*:*:*
Last major update 29-05-2019 - 22:29
Published 27-09-2016 - 15:59
Back to Top