CVE编号
CVE-2015-7501利用情况
漏洞武器化补丁情况
官方补丁披露时间
2017-11-10漏洞描述
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.解决建议
升级Apache Commons Collections组件版本至3.2.2及以上
参考链接 |
|
|---|---|
| http://rhn.redhat.com/errata/RHSA-2015-2500.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2501.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2502.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2514.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2516.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2517.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2521.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2522.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2524.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2670.html | |
| http://rhn.redhat.com/errata/RHSA-2015-2671.html | |
| http://rhn.redhat.com/errata/RHSA-2016-0040.html | |
| http://rhn.redhat.com/errata/RHSA-2016-1773.html | |
| http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html | |
| http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html | |
| http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html | |
| http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html | |
| http://www.securityfocus.com/bid/78215 | |
| http://www.securitytracker.com/id/1034097 | |
| http://www.securitytracker.com/id/1037052 | |
| http://www.securitytracker.com/id/1037053 | |
| http://www.securitytracker.com/id/1037640 | |
| https://access.redhat.com/security/vulnerabilities/2059393 | |
| https://access.redhat.com/solutions/2045023 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1279330 | |
| https://rhn.redhat.com/errata/RHSA-2015-2536.html | |
| https://www.oracle.com/security-alerts/cpujul2020.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | redhat | data_grid | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_a-mq | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_bpm_suite | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_data_virtualization | 5.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_data_virtualization | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 4.3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 5.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_application_platform | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_brms_platform | 5.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_brms_platform | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_soa_platform | 5.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_enterprise_web_server | 3.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_fuse | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_fuse_service_works | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_operations_network | 3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | jboss_portal | 6.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | openshift | 3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | subscription_asset_manager | 1.3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | xpaas | 3.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | apache-commons-collections | * |
Up to (excluding) 3.2.1-11.9.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | apache-commons-collections | * |
Up to (excluding) 3.2.1-11.9.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_5 | apache-commons-collections | * |
Up to (excluding) 3.2-2jpp.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_6 | apache-commons-collections | * |
Up to (excluding) 3.2.1-3.5.el6_7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian | DPKG | * |
Up to (excluding) 0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | apache-commons-collections | * |
Up to (excluding) 4.2-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | apache-commons-collections | * |
Up to (excluding) 4.2-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_12 | apache-commons-collections | * |
Up to (excluding) 4.2-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_6 | apache-commons-collections | * |
Up to (excluding) 3.2.1-4+deb6u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_7 | apache-commons-collections | * |
Up to (excluding) 3.2.1-5+deb7u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | apache-commons-collections | * |
Up to (excluding) 3.2.1-7+deb8u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | apache-commons-collections | * |
Up to (excluding) 4.1-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | apache-commons-collections | * |
Up to (excluding) 4.2-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_5 | apache-commons-collections | * |
Up to (excluding) 3.2-2jpp.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_6 | apache-commons-collections | * |
Up to (excluding) 3.2.1-3.5.el6_7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_7 | apache-commons-collections | * |
Up to (excluding) 3.2.1-22.el7_2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | apache-commons-collections | * |
Up to (excluding) 3.2-2jpp.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_6 | apache-commons-collections | * |
Up to (excluding) 3.2.1-3.5.el6_7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | apache-commons-collections | * |
Up to (excluding) 3.2.1-22.el7_2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_5 | jakarta-commons-collections | * |
Up to (excluding) 0:3.2-2jpp.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_6 | jakarta-commons-collections | * |
Up to (excluding) 0:3.2.1-3.5.el6_7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | apache-commons-collections | * |
Up to (excluding) 0:3.2.1-22.el7_2 |
|||||
- 攻击路径 远程
- 攻击复杂度 容易
- 权限要求 无需权限
- 影响范围 全局影响
- EXP成熟度 漏洞武器化
- 补丁情况 官方补丁
- 数据保密性 数据泄露
- 数据完整性 传输被破坏
- 服务器危害 服务器失陷
- 全网数量 N/A
还没有评论，来说两句吧...