CVE-2017-3203
N/A
N/A
Summary
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Pivotal/Spring | Spring-flex | 0 | affected |
Weaknesses
- CWE-502: CWE-502: Deserialization of Untrusted Data
ADP Enrichment
CVE Program Container
Additional References
- https://codewhitesec.blogspot.com/2017/04/amf.html
- https://www.kb.cert.org/vuls/id/307983
- http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
- https://www.securityfocus.com/bid/97376
References
- https://codewhitesec.blogspot.com/2017/04/amf.html
- https://www.kb.cert.org/vuls/id/307983
- http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution
- https://www.securityfocus.com/bid/97376
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.