#VU831 Arbitrary code execution in Oracle products - CVE-2015-3253

Vulnerability identifier: #VU831

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2015-3253

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Oracle Health Sciences Clinical Development Center
Oracle Retail Order Broker
Oracle Retail Service Backbone
Oracle Retail Store Inventory Management
Oracle Big Data Discovery
Oracle Retail Customer Insights
Oracle Retail Merchandising Insights
Oracle Agile PLM Framework
Oracle Commerce Platform

Software vendor:
Oracle

The vulnerability allows a remote unauthenticated user to cause arbitrary code execution on the target system.
The weakness exists due to improper serialization of runtime/MethodClosure.java. By sending a specially crafted serialized objects attackers can trigger arbitrary code to be executed.
Successful explotation of the vulmerability results in arbitrary code execution or denial of service on the vulnerable system.

Update to version 2.4.5 or later.

• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3253
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html