Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for
    AMF(X) object deserialization by default. During the deserialization process code is executed that for
    several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One
    vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable
    Java deserialization of untrusted data. Other known vectors in third party libraries can be used to
    trigger remote code execution. (CVE-2017-5641)

The version of VMware vCenter Server installed on the remote host is 6.0.x prior to 6.0u3b or 6.5.x prior to 6.5c. It is, therefore, affected by a flaw in FlexBlazeDS when processing AMF3 messages due to allowing the instantiation of arbitrary classes when deserializing objects. An unauthenticated, remote attacker can exploit this, by sending a specially crafted Java object, to execute arbitrary code.

The version of VMware vCenter Server Appliance installed on the remote host is 6.0 prior to Update 3b or 6.5 prior to Update c. It is, therefore, affected by a flaw in FlexBlazeDS when processing AMF3 messages due to allowing the instantiation of arbitrary classes when deserializing objects. An unauthenticated, remote attacker can exploit this, by sending a specially crafted Java object, to execute arbitrary code.

ID	Name	Product	Family	Severity
433677	SCA: security update for org.apache.flex.blazeds:flex-messaging-core, org.apache.flex.blazeds:flex-messaging-remoting (GHSA-w8v7-prhw-xjpw)	Tenable Cloud Security	SCA Checks	critical
433677	SCA: security update for org.apache.flex.blazeds:flex-messaging-core, org.apache.flex.blazeds:flex-messaging-remoting (GHSA-w8v7-prhw-xjpw)	Tenable Self-Hosted Container Security	SCA Checks	critical
99475	VMware vCenter Server 6.0.x < 6.0u3b / 6.5.x < 6.5c BlazeDS AMF3 RCE (VMSA-2017-0007)	Nessus	Misc.	critical
99474	VMware vCenter Server Appliance BlazeDS AMF3 RCE (VMSA-2017-0007)	Nessus	Misc.	critical

Detections

Analytics

CVE-2017-5641

critical

Tenable Plugins

critical

critical

critical

critical