CVE-2016-4974 Improper Input Validation in Apache Qpid AMQP 0-x JMS
HighCVSS 7.5
EPSS 6.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.qpid/qpid-jms-client(Maven) | <= 0.9.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | < 0.10.0 | 0.10.0 |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.1.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.2.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.3.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.4.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.5.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.6.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.7.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.8.0 | No fix listed |
| org.apache.qpid/qpid-jms-client(Maven) | = 0.9.0 | No fix listed |
| apache amqp 0-x jms client | <= 6.0.3 | No fix listed |
| apache jms client amqp | <= 0.9.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- issues.apache.org issue-tracking
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- qpid.apache.org vendor-advisory
- qpid.apache.org vendor-advisory
- github.com
- 20160702 [SECURITY] CVE-2016-4974: Apache Qpid: deserialization of untrusted input while using JMS ObjectMessage mailing-list
- 91537 third-party-advisory vdb-entry
- 1036239 third-party-advisory vdb-entry