The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6936-1 advisory.

    It was discovered that Apache Commons Collections allowed serialization support for unsafe classes by     default. A remote attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

  - The Sites subcomponent is affected by a security bypass     vulnerability in the Apache Xalan-Java library due to a     failure to properly restrict access to certain     properties when FEATURE_SECURE_PROCESSING is enabled. A     remote attacker can exploit this to bypass restrictions     and load arbitrary classes or access external resources.
    (CVE-2014-0107)

  - The WLS Security component is affected by a remote code     execution vulnerability due to unsafe deserialize calls     of unauthenticated Java objects to the Apache Commons     Collections (ACC) library. A remote attacker, via a     crafted serialized Java object in T3 protocol traffic to     TCP port 7001, can exploit this to execute arbitrary     commands. (CVE-2015-4852)

  - An unspecified vulnerability exists in the WLS-Console     subcomponent that allows a remote attacker to affect     the integrity of the system. No other details are     available. (CVE-2016-0464)

  - An unspecified vulnerability exists in the Coherence     Container subcomponent that allows a remote attacker to     affect the confidentiality, integrity, and availability     of the system. No other details are available.
    (CVE-2016-0572)

  - An unspecified vulnerability exists in the WLS Java     Messaging Service subcomponent that allows a remote     attacker to affect the confidentiality, integrity, and     availability of the system. No other details are     available. (CVE-2016-0573)

  - Multiple unspecified vulnerabilities exist in the WLS     Core Components subcomponent that allow a remote     attacker to affect the confidentiality, integrity, and     availability of the system. No other details are     available. (CVE-2016-0574, CVE-2016-0577)

CVE-2015-4852 Java applications that have an endpoint that accepts serialized Java objects, an attacker can combine serializable collections to create arbitrary remote code execution. Based on the FoxGlove, an attack can be done via RMI or HTTP. The vulnerability is actually in InvokerTransformer class. If class path exists for commons-collections or commons-collections4, the vulnerability exits in the application.

Apache Collections-580 - Arbitrary remote code execution with InvokerTransformer With InvokerTransformer, serializable collections can be build that execute arbitrary Java code.
sun.reflect.annotation.AnnotationInvocationHandler#readObject invokes #entrySet and #get on a deserialized collection. If you have an endpoint that accepts serialized Java objects (JMX, RMI, remote EJB, ...) you can combine the two to create arbitrary remote code execution vulnerability.

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WLS Security component due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. An unauthenticated, remote attacker can exploit this to execute arbitrary code on the target host.

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WLS Security component due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. An unauthenticated, remote attacker can exploit this to execute arbitrary Java code in the context of the WebLogic server.

ID	Name	Product	Family	Severity
204940	Ubuntu 14.04 LTS : Apache Commons Collections vulnerability (USN-6936-1)	Nessus	Ubuntu Local Security Checks	critical
88053	Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU)	Nessus	Misc.	high
87432	F5 Networks BIG-IP : Java commons-collections library vulnerability (K30518307)	Nessus	F5 Networks Local Security Checks	high
87209	Oracle WebLogic Server Java Object Deserialization RCE (Local Check)	Nessus	Misc.	critical
87011	Oracle WebLogic Java Object Deserialization RCE	Nessus	Web Servers	critical

Detections

Analytics

CVE-2015-4852

critical

Tenable Plugins

critical

high

high

critical

critical