When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - Apache Groovy: Remote code execution via deserialization (CVE-2016-6814)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4795-1 advisory.

    It was discovered that Apache Groovy incorrectly handled

    serialization mechanisms. An attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities :

  - A deserialization vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion Middleware     (subcomponent: Advanced UI (Apache Groovy)) due to a lack of isolation of object deserialization code. An     unauthenticated, remote attacker can exploit this, via HTTP, to execute arbitrary code on the target host.
    (CVE-2016-6814)

  - A remote code execution vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Apache Commons FileUpload)) due to an unspecified reason. An     unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.
    (CVE-2016-1000031)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Third Party Tools (Apache Batik)) due to an issue with deserialization. An     unauthenticated, remote attacker can exploit this issue, via HTTP, to cause the application to stop     functioning properly. (CVE-2018-8013)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Spring Framework)) due to an issue handling range requests with     a high number of ranges, wide ranges that overlap, or both. An unauthenticated, remote attacker can     exploit this issue, via HTTP, to cause the application to stop responding. (CVE-2018-15765)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-01 (Groovy: Arbitrary code execution)

    It was discovered that there was a vulnerability within the Java       serialization/deserialization process.
  Impact :

    An attacker, by crafting a special serialized object, could execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

The version of Oracle Enterprise Manager Ops Center installed on the remote host is missing a security patch. It is, therefore, affected by a remote code execution vulnerability. Refer to the October 2017 CPU for details on this vulnerability.

The remote Oracle Database Server is missing the October 2017 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by vulnerability in the Spatial (Apache Groovy) component of Oracle Database Server.
Please see the vendor advisory for additional information.

An update for groovy is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby, and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java.

Security Fix(es) :

* It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2016-6814)

Security Fix(es) :

  - It was found that a flaw in Apache groovy library allows     remote code execution wherever deserialization occurs in     the application. It is possible for an attacker to craft     a special serialized object that will execute code     directly when deserialized. All applications which rely     on serialization and do not isolate the code which     deserializes objects are subject to this vulnerability.
    (CVE-2016-6814)

Fixes information disclosure vulnerability (CVE-2016-6814)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2017:2486 :

An update for groovy is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby, and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java.

Security Fix(es) :

* It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2016-6814)

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is prior to 14.2.3, 15.x prior to 15.2.12, or 16.x prior to 16.2.4. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in the     Primavera Integration (Standard) component, specifically     in Apache Standard Taglib, due to an XML external entity     (XXE) injection flaw when parsing XML data because of an     incorrectly configured XML parser accepting XML external     entities from untrusted sources. An unauthenticated,     remote attacker can exploit this, via specially crafted     XML data, to disclose resources on the target system or     utilize XSLT extensions to execute arbitrary code.
    (CVE-2015-0254)

  - A remote code execution vulnerability exists in the     Primavera Integration (Groovy) component due to unsafe     deserialize calls of unauthenticated Java objects to the     Apache Commons Collections (ACC) library. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code on the target host.
    (CVE-2016-6814)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-6814

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that a flaw in Apache Groovy, a dynamic language for the Java Virtual Machine, allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.

For Debian 7 'Wheezy', these problems have been fixed in version 1.8.6-1+deb7u2.

We recommend that you upgrade your groovy packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apache Groovy project reports :

When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized.
All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
This is similar to CVE-2015-3253 but this exploit involves extra wrapping of objects and catching of exceptions which are now safe guarded against.

ID	Name	Product	Family	Severity
199696	RHEL 7 : groovy (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
183704	Ubuntu 16.04 ESM : Apache Groovy vulnerability (USN-4795-1)	Nessus	Ubuntu Local Security Checks	critical
136091	Oracle WebCenter Sites Multiple Vulnerabilities (July 2019 CPU)	Nessus	Windows	critical
134468	GLSA-202003-01 : Groovy: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
104052	Oracle Enterprise Manager Ops Center Remote Code Execution (October 2017 CPU)	Nessus	Misc.	critical
103971	Oracle Database Multiple Vulnerabilities (October 2017 CPU)	Nessus	Databases	critical
103931	Oracle JDeveloper ADF Faces Unspecified Remote Code Execution (October 2017 CPU)	Nessus	Misc.	critical
102879	CentOS 7 : groovy (CESA-2017:2486)	Nessus	CentOS Local Security Checks	critical
102675	Scientific Linux Security Update : groovy on SL7.x (noarch) (20170817)	Nessus	Scientific Linux Local Security Checks	critical
102601	Fedora 25 : groovy18 (2017-33c8085c5d)	Nessus	Fedora Local Security Checks	critical
102574	RHEL 7 : groovy (RHSA-2017:2486)	Nessus	Red Hat Local Security Checks	critical
102570	Oracle Linux 7 : groovy (ELSA-2017-2486)	Nessus	Oracle Linux Local Security Checks	critical
102552	Fedora 26 : groovy18 (2017-661dddc462)	Nessus	Fedora Local Security Checks	critical
101899	Oracle Primavera Gateway Multiple Vulnerabilities (July 2017 CPU)	Nessus	CGI abuses	critical
96734	Fedora 24 : groovy (2017-1ce2a05ff1)	Nessus	Fedora Local Security Checks	critical
96679	Fedora 25 : groovy (2017-cc0e0daf0f)	Nessus	Fedora Local Security Checks	critical
96666	Debian DLA-794-1 : groovy security update	Nessus	Debian Local Security Checks	critical
96511	FreeBSD : groovy -- remote execution of untrusted code/DoS vulnerability (4af92a40-db33-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-6814

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical