Deserialization of Untrusted Data in XML-RPC - CVE-2019-17570

Vulnerability identifier: #VU24686

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17570

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult() method in Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

XML-RPC
Gentoo Linux
Ubuntu
openEuler
Fedora
Red Hat Software Collections
libxmlrpc3-java (Debian package)
swt-chart
xmlrpc
xmlrpc-client
xmlrpc-server
xmlrpc-javadoc
xmlrpc-common
libxmlrpc3-server-java (Ubuntu package)
libxmlrpc3-client-java (Ubuntu package)
libxmlrpc3-common-java (Ubuntu package)
eclipse-pydev
Fuse
IBM Tivoli Netcool/OMNIbus WebGUI

Install update from vendor's website.

XML-RPC - update to 3.1.4
libxmlrpc3-java (Debian package) - update to 3.1.3-9+deb10u1
Fuse - update to 7.6.0
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.40
swt-chart - update to 0.12.0-3.fc32
xmlrpc - update to 3.1.3-2
xmlrpc-client - update to 3.1.3-2
xmlrpc-server - update to 3.1.3-2
xmlrpc-javadoc - update to 3.1.3-2
xmlrpc-common - update to 3.1.3-2
libxmlrpc3-server-java (Ubuntu package) - addressed in versions 3.1.3-7+deb8u1build0.16.04.1, 3.1.3-9+deb10u1build0.18.04.1
libxmlrpc3-client-java (Ubuntu package) - addressed in versions 3.1.3-7+deb8u1build0.16.04.1, 3.1.3-9+deb10u1build0.18.04.1
libxmlrpc3-common-java (Ubuntu package) - addressed in versions 3.1.3-7+deb8u1build0.16.04.1, 3.1.3-9+deb10u1build0.18.04.1
xmlrpc - update to 3.1.3-24.fc32
eclipse-pydev - update to 7.5.0-1.fc32

• http://www.openwall.com/lists/oss-security/2020/01/24/2
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-17570;
• https://lists.apache.org/thread.html/846551673bbb7ec8d691008215384bcef03a3fb004d2da845cfe88ee%401390230951%40%3Cdev.ws.apache.org%3E

• Remote code execution in Apache XML-RPC library
• Red Hat update for rh-java-common-xmlrpc
• Debian update for libxmlrpc3-java
• Multiple vulnerabilities in Red Hat Fuse
• Gentoo update for Apache XML-RPC
• openEuler update for xmlrpc
• openEuler 22.03 LTS update for xmlrpc
• Ubuntu update for libxmlrpc3-java
• Fedora 32 update for eclipse-pydev, swt-chart, xmlrpc
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI