CVE-2016-4978

Artemis: Deserialization of untrusted input vulnerability

Severity Score

7.2

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.

El método getObject de la clase javax.jms.ObjectMessage en el (1) cliente JMS Core, (2) broker Artemis y (3) componente Artemis REST en Apache ActiveMQ Artemis en versiones anteriores a 1.4.0 podría permitir a usuarios remotos autenticados con permiso, mandar mensajes al broker Artemis para deserializar objetos arbitrarios y ejecutar código arbitrario aprovechando clases de gadget presentes en la ruta de clases Artemis.

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2016-05-24 CVE Reserved
2016-09-27 CVE Published
2023-11-20 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (22)

URL	Tag	Source
http://www.securityfocus.com/bid/93142	Third Party Advisory
https://lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2%40%3Cissues.activemq.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02%40%3Cissues.activemq.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E	Mailing List
https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf	Technical Description

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3E	2023-02-12
https://access.redhat.com/errata/RHSA-2017:1834	2023-02-12
https://access.redhat.com/errata/RHSA-2017:1835	2023-02-12
https://access.redhat.com/errata/RHSA-2017:1836	2023-02-12
https://access.redhat.com/errata/RHSA-2017:1837	2023-02-12
https://access.redhat.com/errata/RHSA-2017:3454	2023-02-12
https://access.redhat.com/errata/RHSA-2017:3455	2023-02-12
https://access.redhat.com/errata/RHSA-2017:3456	2023-02-12
https://access.redhat.com/errata/RHSA-2017:3458	2023-02-12
https://access.redhat.com/errata/RHSA-2018:1447	2023-02-12
https://access.redhat.com/errata/RHSA-2018:1448	2023-02-12
https://access.redhat.com/errata/RHSA-2018:1449	2023-02-12
https://access.redhat.com/errata/RHSA-2018:1450	2023-02-12
https://access.redhat.com/errata/RHSA-2018:1451	2023-02-12
https://access.redhat.com/security/cve/CVE-2016-4978	2018-05-14
https://bugzilla.redhat.com/show_bug.cgi?id=1379207	2018-05-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	5.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "5.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.4.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	5.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "5.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.4.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	6.4.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "6.4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.0.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.0.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.1.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.1.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.1.0 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.1.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"	7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"	-	Safe
Apache Search vendor "Apache"		Activemq Artemis Search vendor "Apache" for product "Activemq Artemis"				< 1.4.0 Search vendor "Apache" for product "Activemq Artemis" and version " < 1.4.0"		-		Affected