Infinispan 'hotrod java' Client Remote Code Execution Vulnerability

Bugtraq ID:	101910
Class:	Input Validation Error
CVE:	CVE-2016-0750
Remote:	Yes
Local:	No
Published:	Nov 16 2017 12:00AM
Updated:	Dec 19 2017 10:00PM
Credit:	Sebastian Olsson (TrueSec).
Vulnerable:	Redhat JBoss Data Grid 7.1.0 infinispan infinispan 9.0.0.Final infinispan infinispan 9.0.0.CR3 infinispan infinispan 8.2.6.Final infinispan infinispan 8.2.5.Final infinispan infinispan 8.2.4.Final infinispan infinispan 8.1.7.Final infinispan infinispan 8.1.6.Final
Not Vulnerable:	Redhat JBoss Data Grid 7.1.1 infinispan infinispan 9.1.0.Final

Infinispan 'hotrod java' Client Remote Code Execution Vulnerability

Infinispan is prone to a remote code-execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application.

Infinispan 'hotrod java' Client Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Infinispan 'hotrod java' Client Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Infinispan 'hotrod java' Client Remote Code Execution Vulnerability

References:

• Bug 1300443 - (CVE-2016-0750) CVE-2016-0750 hotrod client: unchecked deserializa (Red Hat)
  
• CVE-2016-0750 (Red Hat)
  
• Infinispan Homepage (infinispan)
  
• ISPN-7781 Add java deserial white list for client #5116 (infinispan)
  
• ISPN-8106 Remove unused imports (infinispan)
  
• RHSA-2017:3244 - Security Advisory (Red Hat)