Critical Remote Command Execution Vulnerability in OpenJDK 8 and libcommons-collections3-java
Summary
UBUNTU-CVE-2015-4852: The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP por... Affects libcommons-collections3-java versions < 3.2.1-6ubuntu0.1~esm1. Fixed in 3.2.1-6ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenJDK 8 is an open-source implementation of the Java Platform, Standard Edition, which is widely used for developing and running Java applications. The libcommons-collections3-java package provides a set of classes for manipulating collections in Java. Both packages are essential for various applications, but they have been found to be vulnerable to a critical security flaw that allows remote attackers to execute arbitrary commands.
Vulnerability Detail
The vulnerability, identified as CVE-2015-4852, originates from the WLS Security component in Oracle WebLogic Server, affecting versions 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0. It allows remote attackers to execute arbitrary commands via crafted serialized Java objects in T3 protocol traffic to TCP port 7001. This vulnerability can lead to severe consequences, including unauthorized access to sensitive data and complete system compromise. The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
How To Fix
Minimum fixed version
3.2.1-6ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-collections3-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to TCP port 7001 to trusted IP addresses only, thereby minimizing the risk of exploitation. Additionally, monitor network traffic for any suspicious activity related to T3 protocol communications.
Conclusion
The CVE-2015-4852 vulnerability poses a significant risk to systems using OpenJDK 8 and libcommons-collections3-java. It is crucial for users to update their packages to the latest patched versions to safeguard against potential exploitation. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for libcommons-collections3-java →
FAQ
CVE-2015-4852 is a critical vulnerability in Oracle WebLogic Server that allows remote code execution through crafted serialized Java objects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete system compromise.
Yes, patched versions of the affected packages are available. Users should update to the latest versions to mitigate the risk.
If you cannot update immediately, restrict access to the affected services and monitor for suspicious activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-collections3-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
