NVD

Id
16800  
Name
CVE-2016-0376  
Description
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-06-03  
Modified Date
2016-11-29  
Seq
2016-0376  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
93369 16800 CVE-2016-0376 SUSE-SU-2016:1299  View
93370 16800 CVE-2016-0376 SUSE-SU-2016:1300  View
93371 16800 CVE-2016-0376 SUSE-SU-2016:1303  View
93372 16800 CVE-2016-0376 SUSE-SU-2016:1378  View
93373 16800 CVE-2016-0376 SUSE-SU-2016:1379  View
93374 16800 CVE-2016-0376 SUSE-SU-2016:1388  View
93375 16800 CVE-2016-0376 SUSE-SU-2016:1458  View
93376 16800 CVE-2016-0376 SUSE-SU-2016:1475  View
93377 16800 CVE-2016-0376 RHSA-2016:0701  View
93378 16800 CVE-2016-0376 RHSA-2016:0702  View
93379 16800 CVE-2016-0376 RHSA-2016:0708  View
93380 16800 CVE-2016-0376 RHSA-2016:0716  View
93381 16800 CVE-2016-0376 RHSA-2016:1039  View
93382 16800 CVE-2016-0376 20160412 [SE-2012-01] Yet another broken security fix in IBM Java 7/8  View
93383 16800 CVE-2016-0376 IX90171  View
93384 16800 CVE-2016-0376 http://www-01.ibm.com/support/docview.wss?uid=swg21980826  View
93385 16800 CVE-2016-0376 http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf  View
93386 16800 CVE-2016-0376 20160412 [SE-2012-01] Yet another broken security fix in IBM Java 7/8  View
93387 16800 CVE-2016-0376 89192  View
93388 16800 CVE-2016-0376 1035953  View
93389 16800 CVE-2016-0376 RHSA-2016:1430  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2264 JVNDB-2016-003037 IBM SDK, Java Technology Edition の com.ibm.rmi.io.SunSerializableFactory クラスにおけるサンドボックス保護メカニズムを回避される脆弱性 IBM SDK, Java Technology Edition の com.ibm.rmi.io.SunSerializableFactory クラスは、AccessController doPrivileged ブロック内のクラスを適切にデシリアライズしないため、サンドボックス保護メカニズムを回避され、任意のコードを実行される脆弱性が存在します。 CVE-2016-0376 86580 CVE-2016-0376 16800 5.1 8.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003037.html 2016-04-26 2016-08-26 View