Spring Framework and Spring Security Remote Security Bypass Vulnerability

Bugtraq ID:	49536
Class:	Input Validation Error
CVE:	CVE-2011-2894
Remote:	Yes
Local:	No
Published:	Sep 09 2011 12:00AM
Updated:	Sep 09 2011 12:00AM
Credit:	Wouter Coekaerts
Vulnerable:	SpringSource Spring Framework 3.0.5 SpringSource Spring Framework 3.0
Not Vulnerable:

Spring Framework and Spring Security Remote Security Bypass Vulnerability

Spring Framework and Spring Security are prone to a remote security-bypass vulnerability.

Remote attackers can exploit this issue to bypass certain security restrictions.

The following products are vulnerable:

Spring Framework versions 3.0.0 through 3.0.5
Spring Security versions 2.0.0 through 2.0.6
Spring Security versions 3.0.0 through 3.0.5

Spring Framework and Spring Security Remote Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Spring Framework and Spring Security Remote Security Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

Spring Framework and Spring Security Remote Security Bypass Vulnerability

References:

• CVE-2011-2894: Spring Framework and Spring Security serialization-based remoting (Spring Source)
  
• Product Homepage (Spring Source)
  
• CVE-2011-2894: Spring Framework and Spring Security serialization-based remotin (s2-security )