CVE-2017-5878

Опубликовано: 08 июн. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.

Ссылки

http://www.openwall.com/lists/oss-security/2017/05/22/2
Mailing List
Third Party Advisory
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/05/22/2
Mailing List
Third Party Advisory
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:red5:media_server:1.0.2:-:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.2:milestone1:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.3:*:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.4:*:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.5:*:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.6:*:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:-:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone1:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone2:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone3:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone4:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone5:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone6:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.7:milestone7:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone1:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone10:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone11:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone12:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone13:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone2:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone3:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone4:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone5:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone6:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone7:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone8:*:*:*:*:*:*

cpe:2.3:o:red5:media_server:1.0.8:milestone9:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.03142

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2017-5878

CVSS3: 9.8

ubuntu

больше 8 лет назад

GHSA-pm34-cp96-7fw6

CVSS3: 9.8

github

больше 3 лет назад

EPSS

Процентиль: 86%

0.03142

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502