Re: Assign CVE for common-collections remote code execution on deserialisation flaw

[Pedro Vaz De Sousa Grilo <pedrosousagrilo () gmail com>]

I think it is. You can execute remote code by exploiting HTTP, RMI and JMI

On Mon, Nov 9, 2015 at 6:58 AM, Florian Weimer <fweimer () redhat com> wrote:

> On 11/09/2015 01:36 AM, Jason Shepherd wrote:
> > Hello oss-esc,
> >
> > It was found that a flaw in Apache commons-collections Java library
> allowed remote code execution when Deserialised with Java Object
> Serialization.
>
> This is not a vulnerability in the library.  How can this feature allow
> remote code execution if it does not involve any networking at all?
>
> The root cause is the incorrect use of Java deserialization.  As long as
> you do not fix that, something else on the classpath will serve the role
> of Apache Commons Collections.
>
> Disabling InvokerTransformer deserialization may be a prudent hardening
> measure, but calling the existing behavior a vulnerability is a bit of a
> stretch.
>
> Florian