Remote code execution in Primavera Unifier - CVE-2018-14718

Vulnerability identifier: #VU17053

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14718

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to the failure to block the slf4j-ext class from polymorphic deserialization. A remote attacker can execute arbitrary code with elevated privileges.

Primavera Unifier
Red Hat OpenShift Container Platform
Enterprise Manager for Virtualization
IBM Disconnected Log Collector
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
JBoss A-MQ
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Oracle Banking Platform
Cloudera Observability with IBM
Dell Support Assist Enterprise
Oracle Financial Services Analytical Applications Infrastructure
Integration Designer
B2B Advanced Communications
Multi-Enterprise Integration Gateway
Storage Virtualize
Fuse
JBoss Data Virtualization
JBoss Data Grid
Oracle Communications Billing and Revenue Management
Oracle WebCenter Portal
Ubuntu
Fedora
libjackson2-databind-java (Ubuntu package)
jackson-databind (Debian package)
bouncycastle
rh-maven35-jackson-databind (Red Hat package)
jackson-parent
jackson-core
jackson-datatypes-collections
jackson-jaxrs-providers
jackson-bom
jackson-datatype-joda
jackson-datatype-jdk8
jackson-annotations
jackson-databind
jackson-dataformat-xml
jackson-dataformats-binary
jackson-module-jsonSchema
jackson-modules-base
jackson-dataformats-text
eclipse-jgit
eclipse-linuxtools
watsonx.data

Install update from vendor's website.

Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Cloudera Observability with IBM - update to 3.6.2
Red Hat OpenShift Container Platform - update to 4.6.26
Dell Support Assist Enterprise - update to 4.00.06.00
OpenShift Logging - update to 5.0.3
Fuse - addressed in versions 6.3.13, 7.5.0
JBoss Data Virtualization - update to 6.4.8
JBoss Data Grid - update to 7.3.2
libjackson2-databind-java (Ubuntu package) - update to 2.4.2-3ubuntu0.1~esm2
jackson-databind (Debian package) - update to 2.8.6-1+deb9u5
bouncycastle - update to 1.61-1.fc29
rh-maven35-jackson-databind (Red Hat package) - update to 2.7.6-2.5.el7
jackson-parent - update to 2.9.1.2-1.fc29
jackson-core - update to 2.9.8-1.fc29
jackson-datatypes-collections - update to 2.9.8-1.fc29
jackson-jaxrs-providers - update to 2.9.8-1.fc29
jackson-bom - update to 2.9.8-1.fc29
jackson-datatype-joda - update to 2.9.8-1.fc29
jackson-datatype-jdk8 - update to 2.9.8-1.fc29
jackson-annotations - update to 2.9.8-1.fc29
jackson-databind - update to 2.9.8-1.fc29
jackson-dataformat-xml - update to 2.9.8-1.fc29
jackson-dataformats-binary - update to 2.9.8-1.fc29
jackson-module-jsonSchema - update to 2.9.8-1.fc29
jackson-modules-base - update to 2.9.8-1.fc29
jackson-dataformats-text - update to 2.9.8-1.fc29
eclipse-jgit - update to 5.2.0-4.fc29
eclipse-linuxtools - update to 7.1.0-3.fc29
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
IBM Disconnected Log Collector - update to 1.8.3
watsonx.data - addressed in versions 2.0.2, 2.0.3
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Security Verify Governance - update to 10.0.1.0.4

• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixEM

• Multiple vulnerabilities in Oracle Primavera
• Debian update for jackson-databind
• Red Hat update for JBoss Fuse/A-MQ
• Red Hat update for OpenShift Container Platform 4.1.18 logging-elasticsearch5
• Red Hat update for FIS 2.0 on Fuse 6.3.0 R13
• Red Hat update for OpenShift Container Platform logging-elasticsearch5-container
• Multiple vulnerabilities in Red Hat JBoss Data Virtualization
• Multiple vulnerabilities in Red Hat Fuse
• Multiple vulnerabilities in Red Hat Data Grid
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Openshift Logging
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in z/Transaction Processing Facility
• IBM Log Analysis update for FasterXML jackson-databind
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in IBM B2B Advanced Communications
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in IBM watsonx.data
• IBM watsonx.data update for FasterXML jackson-databind
• Fedora 29 update for bouncycastle, eclipse-jgit, eclipse-linuxtools, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-dataformats-text, jackson-datatype-jdk8, jackson-datatype-jo
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Enterprise Manager for Virtualization
• Remote code execution in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Primavera Unifier
• Ubuntu update for jackson-databind