Apache commons-collections: Remote code execution during deserialisation (CVE 2015-7501)

Red Hat Product Security has been made aware of a series of issues ranging from important to critical impact in the Apache Commons-Collections library. These issues can allow Remote Code Execution (RCE) if not otherwise protected.

Background Information

• An issue was reported for the Java Object Serialization affecting the JMXInvokerServlet interface:
  http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

• The article describes a security vulnerability when deserializing Java objects from untrusted sources with the Apache commons-collections library , containing certain risky classes, on the classpath. This reported issue impacts many products in the JBoss Middleware Suite, as they include this library.

• This issue is being managed through CVE 2015-7501

• Direct exploitation of this vulnerability requires some means of getting an application to accept an object containing one of the risky classes. The patches linked to in this document address the main vulnerability in the commons-collections library; individual flaws will be addressed in other fixes as they are discovered.

An attacker can use the privileges of the user running JBoss Enterprise Application Platform to execute a command on the system.

The following versions of Red Hat Products are impacted:

• Red Hat JBoss A-MQ 6.x
• Red Hat JBoss BPM Suite (BPMS) 6.x
• Red Hat JBoss BRMS 6.x
• Red Hat JBoss BRMS 5.x
• Red Hat JBoss Data Grid (JDG) 6.x
• Red Hat JBoss Data Virtualization (JDV) 6.x
• Red Hat JBoss Data Virtualization (JDV) 5.x
• Red Hat JBoss Enterprise Application Platform 6.x
• Red Hat JBoss Enterprise Application Platform 5.x
• Red Hat JBoss Enterprise Application Platform 4.3.x
• Red Hat JBoss Fuse 6.x
• Red Hat JBoss Fuse Service Works (FSW) 6.x
• Red Hat JBoss Operations Network (JBoss ON) 3.x
• Red Hat JBoss Portal 6.x
• Red Hat JBoss SOA Platform (SOA-P) 5.x
• Red Hat JBoss Web Server (JWS) 3.x
• Red Hat OpenShift/xPAAS 3.x
• Red Hat Subscription Asset Manager 1.3