Red Hat JBoss Operations Network Java Object Deserialization RCE

Critical Nessus Plugin ID 91487

Synopsis

The remote JBoss Operations Network server is affected by a remote code execution vulnerability

Description

The remote Red Hat JBoss Operations Network server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Jython library. An unauthenticated, remote attacker can exploit this, by sending specially crafted Java objects to the HTTP interface, to execute arbitrary code on the target host.

Solution

Red Hat has released JBoss Operations Network 3.3 Update 06 to address this issue; however, Tenable Research has confirmed that the update did not resolve the issue. To mitigate this issue, users should enable agent authentication.

See Also

https://www.tenable.com/security/research/tra-2016-22

https://access.redhat.com/security/cve/cve-2016-3737

Plugin Details

Severity: Critical

ID: 91487

File Name: jboss_on_deserialize_cc.nasl

Version: $Revision: 1.8 $

Type: remote

Family: Misc.

Published: 2016/06/06

Modified: 2016/09/09

Dependencies: 91488

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: cpe:/a:redhat:jboss_operations_network

Required KB Items: installed_sw/JBoss Operations Network

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 2016/06/24

Vulnerability Publication Date: 2016/05/02

Reference Information

CVE: CVE-2016-3737

BID: 90430

OSVDB: 138083

TRA: TRA-2016-22