Multiple RedHat JBoss products are prone to remote code execution vulnerability.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application.
Information
Redhat Software Collections 1 for RHEL 7 0
Redhat JBoss Web Server (JWS) 3.0
Redhat JBoss SOA Platform (SOA-P) 5.3.1
Redhat JBoss SOA Platform (SOA-P) 5.0
Redhat JBoss Portal 6.0
Redhat JBoss Operations Network (JBoss ON) 3.0
Redhat JBoss Fuse Service Works (FSW) 6.0
Redhat JBoss Fuse 6.0
Redhat JBoss Enterprise Application Platform 4.3.10
Redhat JBoss Enterprise Application Platform 4.3
Redhat JBoss Enterprise Application Platform 6.4
Redhat JBoss Enterprise Application Platform 6.3
Redhat JBoss Enterprise Application Platform 6.2
Redhat JBoss Enterprise Application Platform 6.1
Redhat JBoss Enterprise Application Platform 6.0
Redhat JBoss Enterprise Application Platform 6 EL6
Redhat JBoss Enterprise Application Platform 6 EL5
Redhat JBoss Enterprise Application Platform 5.2
Redhat JBoss Enterprise Application Platform 5.1.2
Redhat JBoss Enterprise Application Platform 5.0
Redhat JBoss Data Virtualization (JDV) 6.0
Redhat JBoss Data Virtualization (JDV) 5.0
Redhat JBoss Data Grid (JDG) 6.5.1
Redhat JBoss Data Grid (JDG) 6.4.1
Redhat JBoss Data Grid (JDG) 6.0
Redhat JBoss BRMS 6.0
Redhat JBoss BRMS 5.0
Redhat JBoss BPM Suite (BPMS) 6.0
Redhat JBoss A-MQ 6.0
Redhat Enterprise Linux Workstation 7
Redhat Enterprise Linux Workstation 6
Redhat Enterprise Linux Server EUS 6.7.z
Redhat Enterprise Linux Server 7
Redhat Enterprise Linux Server 6
Redhat Enterprise Linux HPC Node 7
Redhat Enterprise Linux HPC Node 6
Redhat Enterprise Linux Desktop Workstation 5 client
Redhat Enterprise Linux Desktop 7
Redhat Enterprise Linux Desktop 6
Redhat Enterprise Linux Desktop 5 client
Redhat Enterprise Linux 5 Server
Oracle Weblogic Server 10.3.6 0
Oracle Weblogic Server 12.2.1.0
Oracle Weblogic Server 12.1.3.0
Oracle WebCenter Sites 11.1.1 8.0
Oracle WebCenter Sites 12.2.1.2.0
Oracle WebCenter Sites 12.2.1.1.0
Oracle WebCenter Sites 12.2.1.0.0
Oracle Virtual Desktop Infrastructure 3.3
Oracle Virtual Desktop Infrastructure 3.2
Oracle Utilities Work and Asset Management 1.9.1.2.8
Oracle Utilities Network Management System 1.12.0.3.5
Oracle Utilities Network Management System 1.12.0.2.12
Oracle Utilities Network Management System 1.12.0.1.16
Oracle Utilities Network Management System 1.11.0.5.4
Oracle Utilities Network Management System 1.11.0.4.41
Oracle Utilities Network Management System 1.10.0.6.27
Oracle Utilities Framework 4.3.0.2.0
Oracle Utilities Framework 4.3.0.1.0
Oracle Utilities Framework 4.2.0.3.0
Oracle Utilities Framework 4.2.0.2.0
Oracle Utilities Framework 4.2.0.1.0
Oracle Utilities Framework 4.1.0.2.0
Oracle Utilities Framework 4.1.0.1.0
Oracle Utilities Framework 2.2.0.0.0
Oracle Transportation Management 6.4.1
Oracle Transportation Management 6.4
Oracle Transportation Management 6.3.7
Oracle Transportation Management 6.3.6
Oracle StorageTek Tape Analytics SW Tool 0
Oracle Solaris 11.3
Oracle Retail Xstore Point of Service 7.1
Oracle Retail Xstore Point of Service 7.0
Oracle Retail Xstore Point of Service 6.5
Oracle Retail Xstore Point of Service 6.0
Oracle Retail Xstore Point of Service 5.5
Oracle Retail Xstore Point of Service 5.0
Oracle Retail Store Inventory Management 14.1
Oracle Retail Store Inventory Management 14.0
Oracle Retail Store Inventory Management 13.2
Oracle Retail Store Inventory Management 13.1
Oracle Retail Store Inventory Management 13.0
Oracle Retail Store Inventory Management 12.0
Oracle Retail Service Backbone 15.0
Oracle Retail Returns Management 14.1
Oracle Retail Returns Management 14.0
Oracle Retail Returns Management 13.4
Oracle Retail Returns Management 13.3
Oracle Retail Returns Management 13.2
Oracle Retail Returns Management 13.1
Oracle Retail Returns Management 13.0
Oracle Retail Returns Management 12.0
Oracle Retail Price Management 14.1
Oracle Retail Price Management 14.0
Oracle Retail Price Management 13.2
Oracle Retail Price Management 13.1
Oracle Retail Clearance Optimization Engine 14.0
Oracle Retail Clearance Optimization Engine 13.4
Oracle Retail Clearance Optimization Engine 13.3
Oracle Retail Clearance Optimization Engine 13.2
Oracle Retail Central Office 14.1
Oracle Retail Central Office 14.0
Oracle Retail Central Office 13.4
Oracle Retail Central Office 13.3
Oracle Retail Central Office 13.2
Oracle Retail Central Office 13.1
Oracle Retail Central Office 13.0
Oracle Retail Central Office 12.0
Oracle Retail Back Office 14.1
Oracle Retail Back Office 14.0
Oracle Retail Back Office 13.4
Oracle Retail Back Office 13.3
Oracle Retail Back Office 13.2
Oracle Retail Back Office 13.1
Oracle Retail Back Office 13.0
Oracle Retail Back Office 12.0
Oracle Retail Assortment Planning 15.0
Oracle Retail Assortment Planning 14.1
Oracle Retail Allocation 14.1
Oracle Retail Allocation 14.0
Oracle Retail Allocation 13.3
Oracle Retail Allocation 13.2
Oracle Retail Allocation 13.1
Oracle Retail Allocation 13.0
Oracle Retail Allocation 12.0
Oracle Primavera P6 Enterprise Project Portfolio Management 8.4
Oracle Primavera P6 Enterprise Project Portfolio Management 8.3
Oracle Primavera P6 Enterprise Project Portfolio Management 8.2
Oracle Primavera P6 Enterprise Project Portfolio Management 16.1
Oracle Primavera P6 Enterprise Project Portfolio Management 15.2
Oracle Primavera P6 Enterprise Project Portfolio Management 15.1
Oracle Primavera Contract Management 14.2
Oracle Policy Automation for Mobile Devices 12.1.1
Oracle Policy Automation Connector for Siebel 10.4.6
Oracle Policy Automation Connector for Siebel 10.4.5
Oracle Policy Automation Connector for Siebel 10.4.4
Oracle Policy Automation Connector for Siebel 10.4.3
Oracle Policy Automation Connector for Siebel 10.4.2
Oracle Policy Automation Connector for Siebel 10.4.1
Oracle Policy Automation Connector for Siebel 10.4
Oracle Policy Automation Connector for Siebel 10.3
Oracle Policy Automation 12.1.1
Oracle Policy Automation 12.1
Oracle Policy Automation 10.4.6
Oracle Policy Automation 10.4.5
Oracle Policy Automation 10.4.4
Oracle Policy Automation 10.4.3
Oracle Policy Automation 10.4.2
Oracle Policy Automation 10.4.1
Oracle Policy Automation 10.4
Oracle Policy Automation 10.3.1
Oracle Policy Automation 10.3
Oracle Oracle Transportation Management 6.3.5
Oracle Oracle Transportation Management 6.3.4
Oracle Oracle Transportation Management 6.3.2
Oracle Oracle Transportation Management 6.3.1
Oracle Oracle Transportation Management 6.3
Oracle MySQL Enterprise Monitor 3.3.0.1098
Oracle MySQL Enterprise Monitor 3.2.4.1102
Oracle MySQL Enterprise Monitor 3.2.1.1049
Oracle MySQL Enterprise Monitor 3.1.4.7895
Oracle MySQL Enterprise Monitor 3.1.3.7856
Oracle MICROS XBR 7.0.4
Oracle MICROS XBR 7.0.2
Oracle MICROS Retail XBRi Loss Prevention 10.8.1
Oracle MICROS Retail XBRi Loss Prevention 10.8
Oracle MICROS Retail XBRi Loss Prevention 10.7
Oracle MICROS Retail XBRi Loss Prevention 10.6
Oracle MICROS Retail XBRi Loss Prevention 10.5
Oracle MICROS Retail XBRi Loss Prevention 10.0.1
Oracle Management Pack for Oracle GoldenGate 11.2.1.0.12
Oracle Linux 5
Oracle Insurance Rules Palette 9.7.1
Oracle Insurance Rules Palette 9.6.1
Oracle Insurance Rules Palette 10.2.2
Oracle Insurance Rules Palette 10.2.0
Oracle Insurance Rules Palette 10.1.2
Oracle Insurance Rules Palette 10.0.1
Oracle Insurance Policy Administration J2EE 9.7.1
Oracle Insurance Policy Administration J2EE 9.6.1
Oracle Insurance Policy Administration J2EE 10.2.2
Oracle Insurance Policy Administration J2EE 10.2.0
Oracle Insurance Policy Administration J2EE 10.1.2
Oracle Insurance Policy Administration J2EE 10.0.1
Oracle Insurance IStream 4.3.2
Oracle Insurance Calculation Engine 9.7.1
Oracle Insurance Calculation Engine 10.2.2
Oracle Insurance Calculation Engine 10.1.2
Oracle In-Memory Policy Analytics 12.0.1
Oracle Healthcare Analytics Data Integration 3.1.0.0.0
Oracle Health Sciences Clinical Development Center 3.1.2.0
Oracle Health Sciences Clinical Development Center 3.1.1.0
Oracle Fusion Middleware MapViewer 12.2.1.2
Oracle Fusion Middleware MapViewer 12.2.1.1
Oracle Fusion Middleware MapViewer 11.1.1.9
Oracle Fusion Middleware 11.1.1 7.0
Oracle Fusion Middleware 11.1.1.9
Oracle FLEXCUBE Universal Banking 12.87.2
Oracle FLEXCUBE Universal Banking 12.87.1
Oracle FLEXCUBE Universal Banking 12.2
Oracle FLEXCUBE Universal Banking 12.1
Oracle FLEXCUBE Universal Banking 12.0.3
Oracle FLEXCUBE Universal Banking 12.0.2
Oracle FLEXCUBE Universal Banking 12.0.1
Oracle FLEXCUBE Universal Banking 11.4
Oracle FLEXCUBE Universal Banking 11.3
Oracle FLEXCUBE Private Banking 12.1
Oracle FLEXCUBE Private Banking 12.0.3
Oracle FLEXCUBE Private Banking 12.0.2
Oracle FLEXCUBE Private Banking 12.0.1
Oracle FLEXCUBE Private Banking 12.0
Oracle FLEXCUBE Private Banking 2.2
Oracle FLEXCUBE Private Banking 2.0.1
Oracle FLEXCUBE Private Banking 2.0
Oracle FLEXCUBE Investor Servicing 12.0.1
Oracle FLEXCUBE Enterprise Limits and Collateral Management 12.1
Oracle FLEXCUBE Enterprise Limits and Collateral Management 12.0
Oracle FLEXCUBE Direct Banking 12.0.1
Oracle FLEXCUBE Direct Banking 12.0.3
Oracle FLEXCUBE Direct Banking 12.0.2
Oracle FLEXCUBE Direct Banking 12
Oracle FLEXCUBE Core Banking 11.6.0.0.0
Oracle FLEXCUBE Core Banking 11.5.0.0.0
Oracle Financial Services Lending and Leasing 14.2
Oracle Financial Services Lending and Leasing 14.1
Oracle Financial Services Analytical Applications Infrastructure 8.0.3
Oracle Financial Services Analytical Applications Infrastructure 8.0.2
Oracle Financial Services Analytical Applications Infrastructure 8.0.1
Oracle Financial Services Analytical Applications Infrastructure 8.0
Oracle Financial Services Analytical Applications Infrastructure 7.3.5
Oracle Financial Services Analytical Applications Infrastructure 7.3.4
Oracle Financial Services Analytical Applications Infrastructure 7.3.3
Oracle Financial Services Analytical Applications Infrastructure 7.3.2
Oracle Financial Services Analytical Applications Infrastructure 7.3.1
Oracle Financial Services Analytical Applications Infrastructure 7.3
Oracle Enterprise Manager Ops Center 12.3.2
Oracle Enterprise Manager Ops Center 12.2.2
Oracle Enterprise Manager Ops Center 12.1.4
Oracle Enterprise Linux 7
Oracle Enterprise Linux 6.2
Oracle Enterprise Linux 6
Oracle Endeca Information Discovery Integrator 3.2
Oracle Endeca Information Discovery Integrator 3.1
Oracle Endeca Information Discovery Integrator 3.0
Oracle Endeca Information Discovery Integrator 2.4
Oracle Documaker 0
Oracle Communications WebRTC Session Controller 7.2
Oracle Communications WebRTC Session Controller 7.1
Oracle Communications WebRTC Session Controller 7.0
Oracle Communications Order and Service Management 7.3.5.0
Oracle Communications Order and Service Management 7.3.1.0
Oracle Communications Order and Service Management 7.3.0.0
Oracle Communications Order and Service Management 7.2.4.0
Oracle Communications Network Intelligence 7.3.0.0
Oracle Communications ASAP 7.3
Oracle Communications ASAP 7.2
Oracle Communications ASAP 7.0
Oracle Commerce Guided Search 3.1.2
Oracle Commerce Guided Search 3.1.1
Oracle Commerce Guided Search 11.2
Oracle Commerce Guided Search 11.1
Oracle Commerce Guided Search 11.0
Oracle Commerce Experience Manager 3.1.2
Oracle Commerce Experience Manager 3.1.1
Oracle Commerce Experience Manager 11.2
Oracle Commerce Experience Manager 11.1
Oracle Commerce Experience Manager 11.0
Oracle Business Process Management Suite 12.2.1.1.0
Oracle Business Process Management Suite 11.1.1.9.0
Oracle Banking Platform 2.4.1
Oracle Banking Platform 2.4.0
Oracle Banking Platform 2.3.0
Oracle Banking Digital Experience 15.1
Oracle Agile PLM 9.3.5
Oracle Agile PLM 9.3.4
Oracle Agile Engineering Data Management 6.2
Oracle Agile Engineering Data Management 6.1.3
HP Version Control Repository Manager 7.4.1
HP Version Control Repository Manager 7.4
HP Version Control Repository Manager 7.3.4
HP Version Control Repository Manager 7.3.1
HP Version Control Repository Manager 7.3
HP Version Control Repository Manager 7.2.2
HP Version Control Repository Manager 7.2.1
HP Version Control Repository Manager 7.2
HP Version Control Repository Manager 7.5.0
HP Version Control Repository Manager 7.3.3
HP Version Control Repository Manager 7.3.2
HP Systems Insight Manager 7.1.1
HP Systems Insight Manager 7.5.0
HP Systems Insight Manager 7.4
HP Systems Insight Manager 7.3.2
HP Systems Insight Manager 7.3.1
HP Systems Insight Manager 7.3
HP Systems Insight Manager 7.2.2
HP Systems Insight Manager 7.2.1
HP Systems Insight Manager 7.2
HP Systems Insight Manager 7.0
HP Systems Insight Manager 6.3
HP Systems Insight Manager 6.2
HP Systems Insight Manager 6.1
HP Systems Insight Manager 6.0
HP Systems Insight Manager 5.3
HP Systems Insight Manager 5.0
HP Systems Insight Manager 4.2
HP System Management Homepage 7.5.4
HP System Management Homepage 7.5
HP System Management Homepage 7.4.1
HP System Management Homepage 7.3.2
HP System Management Homepage 7.2.3
HP System Management Homepage 7.2.2
HP System Management Homepage 7.2.1
HP System Management Homepage 7.2
HP System Management Homepage 7.1.2
HP System Management Homepage 7.1.1
HP System Management Homepage 7.4
HP System Management Homepage 7.3.3.1
HP System Management Homepage 7.3.1
HP System Management Homepage 7.3
HP System Management Homepage 7.2.4.1
HP System Management Homepage 7.1
HP System Management Homepage 7.0
HP Server Migration Pack 7.5
HP Matrix Operating Environment 7.5
HP Matrix Operating Environment 7.4
HP Matrix Operating Environment 7.3.2
HP Matrix Operating Environment 7.3.1
HP Matrix Operating Environment 7.3
HP Matrix Operating Environment 7.2.2
HP Matrix Operating Environment 7.2.1
HP Matrix Operating Environment 7.2
HP Insight Control server provisioning 7.4.1
HP Insight Control server provisioning 7.5.0
HP Insight Control server provisioning 7.4.0
HP Insight Control 7.5
HP Insight Control 7.4
HP Insight Control 7.3
HP Insight Control 7.2
CentOS CentOS 6
CentOS CentOS 5
Oracle StorageTek Tape Analytics SW Tool 2.2.1
Oracle Documaker 12.5
Oracle Big Data Graph 1.2
HP Version Control Repository Manager 7.5.1
HP Systems Insight Manager 7.5.1
HP System Management Homepage 7.5.5
HP Server Migration Pack 7.5.1
HP Matrix Operating Environment 7.5.1
HP Insight Control server provisioning 7.5.1
HP Insight Control 7.5.1
Exploit
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
References:
- What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have (foxglovesecurity)
- Bug 1279330 - (CVE-2015-7501) CVE-2015-7501 apache-commons-collections: InvokerT (Bugzilla)
- cpujul2016: Oracle Critical Patch Update Advisory - July 2016 (Oracle)
- Critical Patch Security Advisory - October 2016 (Oracle)
- Do the unserialization/deserialization exploits against the commons-collections (Red Hat)
- HPSBMU03611 rev.1 - HPE Matrix Operating Environment on Windows and Linux, Multi (HP)
- HPSBMU03612 rev.1 - HPE Insight Control on Windows and Linux, Multiple Remote Vu (HP)
- Oracle Critical Patch Update Advisory - April 2017 (Oracle)
- Oracle Critical Patch Update Advisory - January 2017 (Oracle)
- Oracle Critical Patch Update Advisory - October 2017 (Oracle)
- Oracle Linux Bulletin - January 2016 (Oracle)
- Oracle Solaris Third Party Bulletin - July 2016 (Oracle)
- RedHat Advisory RHSA-2015-2500 (RedHat)
- RedHat Security Advisory RHSA-2015-2501 (RedHat)
- RedHat Security Advisory RHSA-2015-2502 (RedHat)
- RedHat Security Advisory RHSA-2015-2514 (RedHat)
- RedHat Security Advisory RHSA-2015-2516 (RedHat)
- RedHat Security Advisory RHSA-2015-2517 (RedHat)
- Ref: linuxbulletinoct2015-2719645 Oracle Linux Bulletin - October 2015 Revision (Oracle)
- RHSA-2015:2671-1 Important: jakarta-commons-collections security update (Red Hat)