Vulnerability Details : CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
Vulnerability category: Input validationExecute code
Exploit prediction scoring system (EPSS) score for CVE-2016-4974
Probability of exploitation activity in the next 30 days: 1.07%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 82 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-4974
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.0
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:P |
6.8
|
6.4
|
NIST |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
NIST |
CWE ids for CVE-2016-4974
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-4974
-
http://www.securityfocus.com/archive/1/538813/100/0/threaded
SecurityFocus
-
http://packetstormsecurity.com/files/137749/Apache-Qpid-Untrusted-Input-Deserialization.html
Apache Qpid Untrusted Input Deserialization ≈ Packet StormThird Party Advisory;VDB Entry
-
http://qpid.apache.org/components/jms/security.html
Security - Apache Qpid™Vendor Advisory
-
http://www.securitytracker.com/id/1036239
Apache Qpid JMS ObjectMessage Deserialization Bug Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
-
https://issues.apache.org/jira/browse/QPIDJMS-188
[QPIDJMS-188] [CVE-2016-4974] allow whitelisting trusted classes/packages for deserialization from ObjectMessage - ASF JIRAIssue Tracking
-
http://qpid.apache.org/components/jms/security-0-x.html
Security - Apache Qpid™Vendor Advisory
-
http://www.securityfocus.com/bid/91537
Apache QPID CVE-2016-4974 Deserialization Security Bypass VulnerabilityVDB Entry;Third Party Advisory
Products affected by CVE-2016-4974
- cpe:2.3:a:apache:jms_client_amqp:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:amqp_0-x_jms_client:*:*:*:*:*:*:*:*