The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2019 CPU advisory.

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Xalan)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Knowledge accessible data as well as unauthorized read access     to a subset of Oracle Knowledge accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Knowledge. (CVE-2014-0107)     
  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Commons BeanUtils)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and     8.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle     Knowledge. (CVE-2014-0114)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Derby)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Knowledge accessible data and unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Knowledge. (CVE-2015-1832)     
  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (JGroups)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle Knowledge.
    (CVE-2016-2141)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Commons FileUpload)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0     and 8.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle     Knowledge. (CVE-2016-1000031)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Web Applications     (InfoCenter)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Knowledge. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Oracle Knowledge, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Knowledge accessible data as well as unauthorized read access to a subset of Oracle     Knowledge accessible data. (CVE-2019-2719)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is 5.7.1 or earlier. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues nor the stand-alone patch but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201604-02 (Xalan-Java: Arbitrary code execution)

    The TransformerFactory in Apache Xalan-Java does not properly restrict       access to certain properties when FEATURE_SECURE_PROCESSING is enabled.
      This can also be exploited via a Java property that is bound to the XSLT       1.0 system-property function.
  Impact :

    A remote attacker could inject specially crafted XSLT properties       resulting in the execution of arbitrary code with the privileges of the       process.
  Workaround :

    There is no known work around at this time.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

  - The Sites subcomponent is affected by a security bypass     vulnerability in the Apache Xalan-Java library due to a     failure to properly restrict access to certain     properties when FEATURE_SECURE_PROCESSING is enabled. A     remote attacker can exploit this to bypass restrictions     and load arbitrary classes or access external resources.
    (CVE-2014-0107)

  - The WLS Security component is affected by a remote code     execution vulnerability due to unsafe deserialize calls     of unauthenticated Java objects to the Apache Commons     Collections (ACC) library. A remote attacker, via a     crafted serialized Java object in T3 protocol traffic to     TCP port 7001, can exploit this to execute arbitrary     commands. (CVE-2015-4852)

  - An unspecified vulnerability exists in the WLS-Console     subcomponent that allows a remote attacker to affect     the integrity of the system. No other details are     available. (CVE-2016-0464)

  - An unspecified vulnerability exists in the Coherence     Container subcomponent that allows a remote attacker to     affect the confidentiality, integrity, and availability     of the system. No other details are available.
    (CVE-2016-0572)

  - An unspecified vulnerability exists in the WLS Java     Messaging Service subcomponent that allows a remote     attacker to affect the confidentiality, integrity, and     availability of the system. No other details are     available. (CVE-2016-0573)

  - Multiple unspecified vulnerabilities exist in the WLS     Core Components subcomponent that allow a remote     attacker to affect the confidentiality, integrity, and     availability of the system. No other details are     available. (CVE-2016-0574, CVE-2016-0577)

The version Oracle WebCenter Sites installed on the remote host is missing a security patch from the January 2016 Critical Patch Update (CPU). It is, therefore, affected by a security bypass vulnerability in the Apache Xalan-Java library due to a failure to properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled. A remote attacker can exploit this to bypass restrictions and load arbitrary classes or access external resources.

xalan-j2 has been updated to ensure that secure processing can't be circumvented. (CVE-2014-0107)

xalan-j2 was updated to ensure secure processing can't be circumvented (CVE-2014-0107).

Updated packages for JBoss Enterprise Application Platform 5.2.0 which fix one security issue and one bug are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam.

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107)

This update also fixes the following bug :

It was observed that when using the Transfomer to convert a StreamSource to DOMResult, the performance of the conversion degraded as the size of the character data increased. For example, converting a 50 MB XML BLOB would take a very long time to finish. This issue has been resolved in this release by adjusting both the SAX2DOM and DOMBuilder classes to handle larger inputs more efficiently.
(JBPAPP-10991)

All users of JBoss Enterprise Application Platform 5.2.0 on Red Hat Enterprise Linux 4, 5, and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

Nicolas Gregoire discovered that Xalan-Java incorrectly handled certain properties when the secure processing feature was enabled. An attacker could possibly use this issue to load arbitrary classes or access external resources.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Red Hat JBoss Enterprise Application Platform 6.2.2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107)

All users of Red Hat JBoss Enterprise Application Platform 6.2.2 on Red Hat Enterprise Linux 5 and 6 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107)

This update fixes a remote code execution security vulnerability (CVE-2014-0107).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated xalan-j2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Xalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types.

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107)

All xalan-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan- Java. (CVE-2014-0107)

From Red Hat Security Advisory 2014:0348 :

Updated xalan-j2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Xalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types.

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features.
A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107)

All xalan-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Nicolas Gregoire discovered several vulnerabilities in libxalan2-java, a Java library for XSLT processing. Crafted XSLT programs could access system properties or load arbitrary classes, resulting in information disclosure and, potentially, arbitrary code execution.

ID	Name	Product	Family	Severity
212392	Oracle Siebel Server 8.5.1.x <= 8.5.1.7 / 8.6.0 / 8.6.1 (April 2019 CPU)	Nessus	Misc.	critical
119149	Tenable SecurityCenter < 5.8.0 Multiple Vulnerabilities (TNS-2018-15)	Nessus	Misc.	critical
90340	GLSA-201604-02 : Xalan-Java: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
88053	Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU)	Nessus	Misc.	high
88044	Oracle WebCenter Sites Apache Xalan-Java Library Security Bypass (January 2016 CPU)	Nessus	Windows	high
76373	SuSE 11.3 Security Update : xalan-j2 (SAT Patch Number 9426)	Nessus	SuSE Local Security Checks	high
76336	openSUSE Security Update : xalan-j2 (openSUSE-SU-2014:0861-1)	Nessus	SuSE Local Security Checks	high
74300	RHEL 5 / 6 : JBoss EAP (RHSA-2014:0591)	Nessus	Red Hat Local Security Checks	high
74137	Ubuntu 10.04 LTS / 12.04 LTS / 13.10 : libxalan2-java vulnerability (USN-2218-1)	Nessus	Ubuntu Local Security Checks	high
73796	RHEL 5 / 6 : JBoss EAP (RHSA-2014:0453)	Nessus	Red Hat Local Security Checks	high
73653	Amazon Linux AMI : xalan-j2 (ALAS-2014-325)	Nessus	Amazon Linux Local Security Checks	high
73359	Fedora 20 : xalan-j2-2.7.1-22.fc20 (2014-4443)	Nessus	Fedora Local Security Checks	high
73356	Fedora 19 : xalan-j2-2.7.1-22.fc19 (2014-4426)	Nessus	Fedora Local Security Checks	high
73309	CentOS 5 / 6 : xalan-j2 (CESA-2014:0348)	Nessus	CentOS Local Security Checks	high
73296	Scientific Linux Security Update : xalan-j2 on SL5.x, SL6.x i386/x86_64 (20140401)	Nessus	Scientific Linux Local Security Checks	high
73295	RHEL 5 / 6 : xalan-j2 (RHSA-2014:0348)	Nessus	Red Hat Local Security Checks	high
73294	Oracle Linux 5 / 6 : xalan-j2 (ELSA-2014-0348)	Nessus	Oracle Linux Local Security Checks	high
73216	Debian DSA-2886-1 : libxalan2-java - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-0107

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high