CVE-2011-3556
published 2011-10-19CVE-2011-3556: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier…
PriorityP179high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
76.24%
99.5th percentile
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | jrockit | <= r28.1.4 | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| oracle | jrockit | — | — |
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | <= 1.5.0 | — |
| sun | jdk | <= 1.4.2_33 | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x50\xac\xed\x00\x05\x77\x22\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\xb6\x89\x8d\x8b\xf2\x86\x43\x75\x72\x00\x18\x5b\x4c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x4f\x62\x6a\x49\x44\x3b\x87\x13\x00\xb8\xd0\x2c\x64\x7e\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00\x77\x08\x00\x00\x00\x00\x00\x00\x00\x00\x73\x72\x00\x14\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x52\x4d\x49\x4c\x6f\x61\x64\x65\x72\xa1\x65\x44\xba\x26\xf9\xc2\xf4\x02\x00\x00\x74\x00\x13\x66\x69\x6c\x65\x3a\x2e\x2f\x72\x6d\x69\x64\x75\x6d\x6d\x79\x2e\x6a\x61\x72\x78\x70\x77\x01\x00\x0a
- →Detect Java RMI DGC exploit traffic by looking for the JRMI protocol header (bytes 4A 52 4D 49) followed by version 0x0002 and StreamType 0x4b on TCP port 1099 ↗
- →Detect Java serialization magic bytes (AC ED 00 05) within RMI DGC traffic on port 1099, indicating a serialized object being sent to the RMI endpoint ↗
- →Alert on HTTP responses serving application/java-archive content-type from an RMI-related process, as the exploit causes the victim JVM to fetch and load a remote JAR payload over HTTP ↗
- →The exploit targets the RMI Distributed Garbage Collector (DGC) endpoint available on every RMI service; monitor for unexpected outbound HTTP connections from Java processes listening on port 1099 ↗
- →The exploit does not work against JMX-only ports unless another RMI endpoint is co-located; scope RMI DGC detection to non-JMX RMI listeners ↗
- →RMI method calls carry no authentication; any unauthenticated connection to a Java RMI registry port (default 1099) should be treated as potentially malicious in hardened environments ↗
- ·Exploitation requires the RMI Registry or RMI Activation service to be configured to allow loading classes from remote (HTTP) URLs — the default insecure configuration. Hardened deployments that restrict remote class loading are not exploitable. ↗
- ·The vulnerability affects Java SE JDK/JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier; patched versions are not vulnerable. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
vendor_ubuntu4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nginx: SMTP STARTTLS plaintext injection flaw
vendor_redhat·2014-08-05·CVSS 6.8
CVE-2014-3556 [MEDIUM] nginx: SMTP STARTTLS plaintext injection flaw
nginx: SMTP STARTTLS plaintext injection flaw
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Statement: This issue did not affect the versions of nginx as shipped with Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 and 7.
Package: nginx14-nginx (Red Hat Software Collections) - Not affected
Package: nginx16-nginx (Red Hat Software Collections) - Affected
Ubuntu
OpenJDK 6 regression
vendor_ubuntu·2012-01-24·CVSS 4.3
CVE-2011-3389 [MEDIUM] OpenJDK 6 regression
Title: OpenJDK 6 regression
Summary: USN-1263-1 caused a regression when using OpenJDK 6's SSL/TLS
implementation.
USN-1263-1 fixed vulnerabilities in OpenJDK 6. The upstream patch for
the chosen plaintext attack on the block-wise AES encryption algorithm
(CVE-2011-3389) introduced a regression that caused TLS/SSL connections
to fail when using certain algorithms. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Deepak Bhole discovered a flaw in the Same Origin Policy (SOP)
implementation in the IcedTea web browser plugin. This could allow a
remote attacker to open connections to certain hosts that should
not be permitted. (CVE-2011-3377)
Juliano Rizzo and Thai Duong discovered that the block-wise AES
encryption algorithm block-wise as use
Ubuntu
IcedTea-Web, OpenJDK 6 vulnerabilities
vendor_ubuntu·2011-11-16·CVSS 4.3
CVE-2011-3389 [MEDIUM] IcedTea-Web, OpenJDK 6 vulnerabilities
Title: IcedTea-Web, OpenJDK 6 vulnerabilities
Summary: Multiple OpenJDK 6 and IcedTea-Web vulnerabilities have been fixed.
Deepak Bhole discovered a flaw in the Same Origin Policy (SOP)
implementation in the IcedTea web browser plugin. This could allow a
remote attacker to open connections to certain hosts that should
not be permitted. (CVE-2011-3377)
Juliano Rizzo and Thai Duong discovered that the block-wise AES
encryption algorithm block-wise as used in TLS/SSL was vulnerable to
a chosen-plaintext attack. This could allow a remote attacker to view
confidential data. (CVE-2011-3389)
It was discovered that a type confusion flaw existed in the in
the Internet Inter-Orb Protocol (IIOP) deserialization code. A
remote attacker could use this to cause an untrusted application
or applet to
Red Hat
OpenJDK: RMI registry privileged code execution (RMI, 7083012)
vendor_redhat·2011-10-18·CVSS 7.5
CVE-2011-3557 [HIGH] OpenJDK: RMI registry privileged code execution (RMI, 7083012)
OpenJDK: RMI registry privileged code execution (RMI, 7083012)
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
Package: java-1.5.0-ibm (Red Hat Enterprise Linux 4) - Affected
Package: java-1.4.2-ibm-sap (Red Hat Enterprise Linux 6) - Affected
Red Hat
OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
vendor_redhat·2011-10-18·CVSS 7.5
CVE-2011-3556 [HIGH] OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
Package: java-1.4.2-ibm-sap (Red Hat Enterprise Linux 6) - Affected
GHSA
GHSA-7fq2-gpx6-fhfw: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2011-3557 [HIGH] GHSA-7fq2-gpx6-fhfw: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3556.
GHSA
GHSA-x97f-rpv2-wwmc: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
ghsa_unreviewed·2022-05-14·CVSS 6.8
CVE-2011-3556 [MEDIUM] GHSA-x97f-rpv2-wwmc: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
No detection rules found.
Exploit-DB
Java RMI - Server Insecure Default Configuration Java Code Execution (Metasploit)
exploitdb·2011-07-15
CVE-2011-3556 Java RMI - Server Insecure Default Configuration Java Code Execution (Metasploit)
Java RMI - Server Insecure Default Configuration Java Code Execution (Metasploit)
---
##
# $Id: java_rmi_server.rb 13186 2011-07-15 20:44:08Z egypt $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Java RMI Server Insecure Default Configuration Java Code Execution',
'Description' => %q{
This module takes advantage of the default configuration of the RMI Registry and
RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it
invokes a method in the RMI Distributed Garbage Collector which is available via every
RMI
Metasploit
Java RMI Server Insecure Endpoint Code Execution Scanner
metasploit
Java RMI Server Insecure Endpoint Code Execution Scanner
Java RMI Server Insecure Endpoint Code Execution Scanner
Detect Java RMI endpoints
Metasploit
Java RMI Server Insecure Default Configuration Java Code Execution
metasploit
Java RMI Server Insecure Default Configuration Java Code Execution
Java RMI Server Insecure Default Configuration Java Code Execution
This module takes advantage of the default configuration of the RMI Registry and RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every RMI endpoint, it can be used against both rmiregistry and rmid, and against most other (custom) RMI endpoints as well. Note that it does not work against Java Management Extension (JMX) ports since those do not support remote class loading, unless another RMI endpoint is active in the same Java process. RMI method calls do not support or require any sort of authentication.
Bugzilla
CVE-2011-3556 OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
bugzilla·2011-10-12·CVSS 7.5
CVE-2011-3556 [HIGH] CVE-2011-3556 OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
CVE-2011-3556 OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
It was found that RMI Registry implementation in OpenJDK did not properly restrict access to some of its methods. A remote client able to connect to the RMI Registry could use this flaw to execute arbitrary code on the server running the registry.
Discussion:
External References:
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
Via RHSA-2011:1380 https://rhn.redhat.com/errata/RHSA-2011-1380.html
---
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 6
Supplementary for Red Hat Enterprise Linux 5
Extras for RHEL 4
Via RHSA-2
arXiv
Autosploit: A Fully Automated Framework for Evaluating the Exploitability of Security Vulnerabilities
arxiv_fulltext·2020-06-30
Autosploit: A Fully Automated Framework for Evaluating the Exploitability of Security Vulnerabilities
: A Fully Automated Framework for Evaluating
the Exploitability of Security Vulnerabilities
Noam Moscovich [1], Ron Bitton [1], Yakov Mallah [1], Masaki Inokuchi [2], Tomohiko Yagyu [2], Yuval Elovici [1] and Asaf Shabtai [1]
[1]Dept. of Software and Information Systems Engineering, Ben-Gurion University of the Negev
[2]NEC Corporation
## Abstract
The existence of a security vulnerability in a system does not necessarily mean that it can be exploited.
In this research, we introduce an automated framework for evaluating the exploitability of vulnerabilities.
Given a vulnerable environment and relevant exploits, will automatically test the exploits on different configurations of the environment in order to identify the specific properties necessary for successful exploitation of the exi
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.htmlhttp://marc.info/?l=bugtraq&m=132750579901589&w=2http://marc.info/?l=bugtraq&m=133365109612558&w=2http://marc.info/?l=bugtraq&m=133728004526190&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://osvdb.org/76505http://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48308http://secunia.com/advisories/48692http://secunia.com/advisories/49198http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.ibm.com/developerworks/java/jdk/alerts/http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1384.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1478.htmlhttp://www.redhat.com/support/errata/RHSA-2012-0006.htmlhttp://www.securityfocus.com/bid/50231http://www.securitytracker.com/id?1026215http://www.ubuntu.com/usn/USN-1263-1https://exchange.xforce.ibmcloud.com/vulnerabilities/70837https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14316https://www.kb.cert.org/vuls/id/597809http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.htmlhttp://marc.info/?l=bugtraq&m=132750579901589&w=2http://marc.info/?l=bugtraq&m=133365109612558&w=2http://marc.info/?l=bugtraq&m=133728004526190&w=2http://marc.info/?l=bugtraq&m=134254866602253&w=2http://marc.info/?l=bugtraq&m=134254957702612&w=2http://osvdb.org/76505http://rhn.redhat.com/errata/RHSA-2013-1455.htmlhttp://secunia.com/advisories/48308http://secunia.com/advisories/48692http://secunia.com/advisories/49198http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.ibm.com/developerworks/java/jdk/alerts/http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1384.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1478.htmlhttp://www.redhat.com/support/errata/RHSA-2012-0006.htmlhttp://www.securityfocus.com/bid/50231http://www.securitytracker.com/id?1026215http://www.ubuntu.com/usn/USN-1263-1https://exchange.xforce.ibmcloud.com/vulnerabilities/70837https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14316https://www.kb.cert.org/vuls/id/597809
2011-10-19
Published