NVD

Id
20409  
Name
CVE-2016-4974  
Description
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-07-13  
Modified Date
2016-09-01  
Seq
2016-4974  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
111550 20409 CVE-2016-4974 http://packetstormsecurity.com/files/137749/Apache-Qpid-Untrusted-Input-Deserialization.html  View
111551 20409 CVE-2016-4974 http://qpid.apache.org/components/jms/security-0-x.html  View
111552 20409 CVE-2016-4974 http://qpid.apache.org/components/jms/security.html  View
111553 20409 CVE-2016-4974 20160702 [SECURITY] CVE-2016-4974: Apache Qpid: deserialization of untrusted input while using JMS ObjectMessage  View
111554 20409 CVE-2016-4974 91537  View
111555 20409 CVE-2016-4974 1036239  View
111556 20409 CVE-2016-4974 https://issues.apache.org/jira/browse/QPIDJMS-188  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2989 JVNDB-2016-003762 Apache Qpid AMQP 0-x JMS Client および JMS における任意のオブジェクトをデシリアライズされる脆弱性 Apache Qpid AMQP 0-x JMS Client および JMS (AMQP 1.0) は、クラスパスで使用可能なクラスを制限しないため、任意のオブジェクトをデシリアライズされる、および任意のコードを実行される脆弱性が存在します。 CVE-2016-4974 91480 CVE-2016-4974 20409 6 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003762.html 2016-06-27 2016-09-06 View