Oracle WebLogic Java对象反序列化远程代码执行漏洞

详细信息

漏洞类型

命令注入

漏洞描述

Oracle WebLogic Server是美国甲骨文（Oracle）公司的一款适用于云环境和传统环境的应用服务器，它提供了一个现代轻型开发平台，支持应用从开发到生产的整个生命周期管理，并简化了应用的部署和管理。WLS Security是其中的一个安全组件。Oracle WebLogic Server 10.3.6.0、12.1.2.0、12.1.3.0 和 12.2.1.0中的WLS安全组件允许远程攻击者通过T3协议流量中到TCP端口 7001的特制序列化Java对象执行任意命令，与oracle_common/modules/com.bea.core.apache.commons.collections.jar有关。注：本CVE的范围仅限于WebLogic服务器产品。

修复建议

有关修补程序、升级或建议的解决方法信息，请参阅针对CVE-2015-4852的Oracle Security Alert： http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

参考链接

• https://www.exploit-db.com/exploits/42806/

  CVE · exploit · x_refsource_EXPLOIT-DB

• http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html

  CVE · x_refsource_CONFIRM

• http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

  CVE · x_refsource_CONFIRM

• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

  CVE · x_refsource_CONFIRM

• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

  CVE · x_refsource_CONFIRM

• https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852

  CVE · x_refsource_CONFIRM

• http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

  CVE · x_refsource_MISC

• https://www.exploit-db.com/exploits/46628/

  CVE · exploit · x_refsource_EXPLOIT-DB

• http://www.openwall.com/lists/oss-security/2015/11/17/19

  CVE · mailing-list · x_refsource_MLIST

• http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

  CVE · x_refsource_CONFIRM

• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

  CVE · x_refsource_CONFIRM

• https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py

  CVE · x_refsource_MISC

• https://www.exploit-db.com/exploits/46628

  CVE · x_refsource_EXPLOIT-DB · exploit

• https://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html

  CVE · x_refsource_MISC

• http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html

  CVE · x_refsource_MISC

• https://ubuntu.com/security/CVE-2015-4852

  OSV

• https://issues.apache.org/jira/browse/COLLECTIONS-580

  OSV

• http://www.openwall.com/lists/oss-security/2015/11/09/1

  OSV

• http://www.infoq.com/news/2015/11/commons-exploit

  OSV

• https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread

  OSV

• https://www.kb.cert.org/vuls/id/576313

  OSV

• https://access.redhat.com/solutions/2045023

  OSV

• https://www.cve.org/CVERecord?id=CVE-2015-4852

  OSV

• https://ubuntu.com/security/notices/USN-6936-1

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-4852

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852

  NVD · US Government Resource