Deserialization of Untrusted Data in Spring Framework - CVE-2016-1000027

Vulnerability identifier: #VU76601

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-1000027

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Spring Framework
IBM Process Mining
IBM Sterling Partner Engagement Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling Control Center
IBM SPSS Collaboration and Deployment Services
Bitbucket Data Center
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
watsonx.data
Library Support for Spring
Cloud Pak for Network Automation
DB2 Data Management Console
DB2 Data Management Console on CPD
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
DevOps Solution Workbench
Oracle BI Publisher
IBM i Modernization Engine for Lifecycle Integration
Storage Copy Data Management
Analytics Content Hub
IBM ECM Content Management Interoperability Services
Maximo Application Suite - Monitor Component
OpenPages for IBM Cloud Pak for Data
IBM Engineering Requirements Management DOORS Next
IBM Qradar SIEM
Cloud Pak for Security (CP4S)
IBM Cognos Controller
OpenView Performance Manager (OVPM)
Bitbucket Server

Install updates from vendor's website.

Spring Framework - update to 6.0.0
IBM Process Mining - update to 1.14.1
watsonx.data - update to 2.1
Cloud Pak for Network Automation - update to 2.7.1
DB2 Data Management Console - update to 3.1.13.1
DB2 Data Management Console on CPD - update to 4.7.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Qradar SIEM - update to 7.5.0 Update Pack 7
OpenView Performance Manager (OVPM) - update to T0684V01^ABL
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.4
Cloud Pak for Security (CP4S) - update to 1.10.12.0
Storage Copy Data Management - update to 2.2.26.0
Analytics Content Hub - update to 2.3
IBM ECM Content Management Interoperability Services - update to 3.0.7.0.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7.1
IBM Sterling Control Center - update to 6.3.0.0.4
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.13
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
Bitbucket Server - update to 8.19.25
Bitbucket Data Center - update to 8.19.25
OpenPages for IBM Cloud Pak for Data - update to 8.302.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM Security Verify Governance - update to 10.0.2.0.2
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2

• https://security-tracker.debian.org/tracker/CVE-2016-1000027
• https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json
• https://www.tenable.com/security/research/tra-2016-20
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
• https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417
• https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626
• https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
• https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525
• https://security.netapp.com/advisory/ntap-20230420-0009/

• Deserialization of untrusted data in IBM ECM Content Management Interoperability Services (CMIS)
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Cognos Controller
• Deserialization of untrusted data in IBM OpenPages for Cloud Pak for Data
• Deserialization of untrusted data in IBM Process Mining
• Deserialization of untrusted data in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Deserialization of untrusted data in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in IBM Sterling Control Center
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in HPE OpenView Performance Manager (OVPM)
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Analytics Content Hub
• Multiple vulnerabilities in Oracle BI Publisher
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in IBM DevOps Solution Workbench
• Bitbucket Data Center and Server update for Pivotal Spring Framework
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Library Support for Spring