Deserialization of Untrusted Data in Oracle WebLogic Server - CVE-2015-4852

Vulnerability identifier: #VU47859

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-4852

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the WLS Security component. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Oracle WebLogic Server
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
Ubuntu
libcommons-collections3-java (Ubuntu package)
apache-commons-beanutils
apache-commons-beanutils-javadoc
Jazz Foundation

Install updates from vendor's website.

Oracle WebLogic Server - update to 12.2.1.1
libcommons-collections3-java (Ubuntu package) - update to Ubuntu Pro
apache-commons-beanutils - update to 1.11.0-7.3.1
apache-commons-beanutils-javadoc - update to 1.11.0-7.3.1
Jazz Foundation - update to 7.0.2.0.29

• http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
• http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
• http://www.openwall.com/lists/oss-security/2015/11/17/19
• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html
• http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
• http://www.securityfocus.com/bid/77539
• http://www.securitytracker.com/id/1038292
• https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852
• https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py
• https://www.exploit-db.com/exploits/42806/
• https://www.exploit-db.com/exploits/46628/

• Remote code execution in Oracle WebLogic Server
• Multiple vulnerabilities in IBM Jazz Foundation
• Ubuntu update for libcommons-collections3-java
• SUSE update for apache-commons-beanutils