Desereliazation of untrusted data in Code42 CrashPlan - CVE-2017-9830
Published: April 2, 2018
Vulnerability identifier: #VU11454
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-9830
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Code42
Affected software:
Code42 CrashPlan
Code42 CrashPlan
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the org.apache.commons.ssl.rmi.DateRMI Java class due to creating an RMI server that listens on a TCP port and deserializes objects sent by TCP clients. A remote attacker can execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the org.apache.commons.ssl.rmi.DateRMI Java class due to creating an RMI server that listens on a TCP port and deserializes objects sent by TCP clients. A remote attacker can execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
How to mitigate CVE-2017-9830
Install update from vendor's website.