FasterXML Jackson-databind CVE-2018-7489 Incomplete Fix Remote Code Execution Vulnerability

Bugtraq ID:	103203
Class:	Design Error
CVE:	CVE-2018-7489
Remote:	Yes
Local:	No
Published:	Feb 26 2018 12:00AM
Updated:	Jul 17 2019 09:00AM
Credit:	Unknown
Vulnerable:	Redhat Subscription Asset Manager 1.0.0 Redhat Satellite 6 Oracle Retail Xstore Point of Service 17.0.2 Oracle Retail Xstore Point of Service 16.0.4 Oracle Retail Xstore Point of Service 15.0.2 Oracle Retail Xstore Point of Service 7.1.7 Oracle Retail Xstore Point of Service 7.0.7 Oracle Retail Xstore Point of Service 6.5.12 Oracle Retail Workforce Management Software 1.60.9.0.0 Oracle Retail Sales Audit 16.0 Oracle Retail Sales Audit 15.0 Oracle Retail Invoice Matching 16.0 Oracle Retail Invoice Matching 15.0 Oracle Retail Assortment Planning 15.0 Oracle Retail Allocation 16.0 Oracle Retail Allocation 15.0 Oracle Primavera Gateway 17.12 Oracle Primavera Gateway 16.2 Oracle Primavera Gateway 15.2 Oracle Primavera Gateway 15.1 Oracle JD Edwards EnterpriseOne Tools 9.2 Oracle JD Edwards EnterpriseOne Orchestrator 9.2 Oracle Identity Manager 12.2.1.3.0 Oracle Identity Manager 11.1.2.3.0 Oracle Global Lifecycle Management OPatchAuto 12.2.0.1.0 Oracle Global Lifecycle Management OPatchAuto 0 Oracle Financial Services Market Risk Measurement and Management 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.1 Oracle Financial Services Analytical Applications Infrastructure 8.0 Oracle Database 18c 0 Oracle Communications Instant Messaging Server 10.0.1 FasterXML jackson-databind 2.9.4 FasterXML jackson-databind 2.9 FasterXML jackson-databind 2.8.11 FasterXML jackson-databind 2.8.10 FasterXML jackson-databind 2.8.9 FasterXML jackson-databind 2.8.8 FasterXML jackson-databind 2.8.7 FasterXML jackson-databind 2.8.8.1 FasterXML jackson-databind 2.7.9.1 FasterXML jackson-databind 2.6.7.1
Not Vulnerable:	Oracle Global Lifecycle Management OPatchAuto 12.2.0.1.14 FasterXML jackson-databind 2.9.5 FasterXML jackson-databind 2.8.11.1

FasterXML Jackson-databind CVE-2018-7489 Incomplete Fix Remote Code Execution Vulnerability

FasterXML Jackson-databind is prone to a remote-code execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.

Note: This issue is the result of an incomplete fix for the issue described in BID 99623 (FasterXML Jackson-databind CVE-2017-7525 Deserialization Remote Code Execution Vulnerability).

jackson-databind prior to 2.8.11.1 and 2.9.x prior to 2.9.5 are vulnerable.

FasterXML Jackson-databind CVE-2018-7489 Incomplete Fix Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FasterXML Jackson-databind CVE-2018-7489 Incomplete Fix Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FasterXML Jackson-databind CVE-2018-7489 Incomplete Fix Remote Code Execution Vulnerability

References:

• FasterXML/jackson-databind Home Page (FasterXML)
  
• Fix #1931 (Github)
  
• Two more `c3p0` gadgets to exploit default typing issue #1931 (Github)
  
• Bug 1549276 CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 (Redhat)
  
• CVE-2018-7489 (Redhat)
  
• Oracle Critical Patch Update Advisory - April 2018 (Oracle)
  
• Oracle Critical Patch Update Advisory - April 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2018 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)