CVE-2016-3427
published 2016-04-21CVE-2016-3427: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-06-02
Exploited in the wild
EPSS
92.33%
99.8th percentile
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Affected
115 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cassandra | — | — |
| apache | cassandra | >= 2.1.0 < 2.1.22 | 2.1.22 |
| apache | cassandra | >= 2.2.0 < 2.2.18 | 2.2.18 |
| apache | cassandra | >= 3.0.0 < 3.0.22 | 3.0.22 |
| apache | cassandra | >= 3.11.0 < 3.11.8 | 3.11.8 |
| apache | tomcat | < 6.0.48 | 6.0.48 |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | >= 7.0.0 < 7.0.73 | 7.0.73 |
| apache | tomcat | >= 8.0 < 8.0.39 | 8.0.39 |
| apache | tomcat | >= 8.5.0 < 8.5.7 | 8.5.7 |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | openjdk-8 | < openjdk-8 8u91-b14-1 (sid) | openjdk-8 8u91-b14-1 (sid) |
| debian | tomcat9 | — | — |
| netapp | storagegrid | <= 9.0.4 | — |
| netapp | vasa_provider_for_clustered_data_ontap | >= 7.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes
4a524d4900024b
bytes
000c31302e36352e3135372e313000000000
bytes
50aced00057722000000000000000000000000000000000000000000000000000244154dc9d4e63bdf7400066a6d78726d69
bytes
50aced000577220000000000000002000000000000000000000000000000000001f6b6898d8bf28643757200185b4c6a6176612e726d692e7365727665722e4f626a49443b871300b8d02c647e02000070787000000001737200156a6176612e726d692e7365727665722e4f626a4944a75efa128ddce55c0200024a00066f626a4e756d4c000573706163657400154c6a6176612f726d692f7365727665722f5549443b7078702d4f7f1ffa7877b4737200136a6176612e726d692e7365727665722e5549440f12700dbf364f12020003530005636f756e744a000474696d65490006756e69717565707870800100000192f5ff701a9cb3f67477088000000000000000737200126a6176612e726d692e6467632e4c65617365b0b5e2660c4adc340200024a000576616c75654c0004766d69647400134c6a6176612f726d692f6467632f564d49443b70787000000000000927c0737200116a6176612e726d692e6467632e564d4944f8865bafa4a56db60200025b0004616464727400025b424c000375696471007e0003707870757200025b42acf317f8060854e002000070787000000008f1c6fcc113e4dd097371007e0005800100000192f6835b0fb632f8a1
bytes
43726564656e7469616c732073686f756c6420626520537472696e675b5d20696e7374656164206f66206a6176612e7574696c2e486173684d61707572
- →Exploit initiates a raw TCP connection to the RMI registry port and sends the RMI handshake magic bytes 'JRMI\x00\x02K' (hex: 4a524d4900024b). Detect this byte sequence on JMX/RMI ports.
- →After the RMI handshake, the exploit parses the response for the string 'UnicastRef2' to extract the rmiServerPort dynamically. Network inspection of RMI responses containing 'UnicastRef2' followed by a port extraction pattern is indicative of reconnaissance for this exploit.
- →The exploit sends a URLDNS Java deserialization payload (java.util.HashMap + java.net.URL gadget chain) to the rmiServerPort. The payload begins with the Java serialization magic bytes 'aced0005' (hex). Detect Java deserialization payloads on JMX/RMI ports.
- →A successful exploitation attempt triggers an out-of-band DNS callback to an interactsh/OAST domain. Monitor for unexpected DNS lookups originating from JMX/RMI service processes.
- →The server-side error response 'Credentials should be String[] instead of java.util.HashMap' (hex: 43726564656e7469616c732073686f756c6420626520537472696e675b5d20696e7374656164206f66206a6176612e7574696c2e486173684d61707572) in the RMI response confirms the vulnerability is present and the deserialization payload was processed.
- →The vulnerability is exploitable only when JmxRemoteLifecycleListener is configured and JMX ports are network-accessible. Audit Tomcat configurations for JmxRemoteLifecycleListener usage and exposed JMX ports. ↗
- →For vRealize Operations Manager (non-appliance), block external access to ports 9004, 9005, 9006, 9007, 9008 to mitigate remote exploitation of CVE-2016-3427. ↗
- ·The Tomcat-side vulnerability (CVE-2016-8735) only affects instances built from source using EWS 2.x or JWS 3.x distributions that include JmxRemoteLifecycleListener; standard Red Hat RPM-packaged Tomcat packages are not affected. ↗
- ·CVE-2016-3427 affects the RMI server in the JMX component of OpenJDK/Oracle JRE: the server deserializes any class when deserializing authentication credentials, enabling unauthenticated attackers with JMX port access to trigger deserialization flaws. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
ghsa9.8CRITICAL
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_apache9.8HIGH
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.6CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Tomcat up to 9.0.0.M11 JmxRemoteLifecycleListener privileges management (Nessus ID 99778 / ID 124624)
vuldb·2026-04-23·CVSS 9.8
CVE-2016-3427 [CRITICAL] Apache Tomcat up to 9.0.0.M11 JmxRemoteLifecycleListener privileges management (Nessus ID 99778 / ID 124624)
A vulnerability marked as critical has been reported in Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11. Affected by this vulnerability is an unknown functionality of the component JmxRemoteLifecycleListener. The manipulation leads to improper privilege management.
This vulnerability is uniquely identified as CVE-2016-3427. The attack is possible to be carried out remotely. Moreover, an exploit is present.
It is suggested to upgrade the affected component.
VulDB
Oracle Java SE 6u113/7u99/8u77 JMX Remote Code Execution (Nessus ID 99778 / ID 124624)
vuldb·2026-04-23·CVSS 9.8
CVE-2016-3427 [CRITICAL] Oracle Java SE 6u113/7u99/8u77 JMX Remote Code Execution (Nessus ID 99778 / ID 124624)
A vulnerability marked as very critical has been reported in Oracle Java SE 6u113/7u99/8u77. Affected is an unknown function of the component JMX. Performing a manipulation results in Remote Code Execution.
This vulnerability was named CVE-2016-3427. The attack may be initiated remotely. In addition, an exploit is available.
It is suggested to upgrade the affected component.
GHSA
Apache Tomcat Improper Access Control vulnerability
ghsa·2022-05-13·CVSS 9.8
CVE-2016-8735 [CRITICAL] CWE-284 Apache Tomcat Improper Access Control vulnerability
Apache Tomcat Improper Access Control vulnerability
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports.
The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
GHSA
GHSA-php4-mj74-f79r: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28
ghsa_unreviewed·2022-05-13
CVE-2016-3427 [CRITICAL] CWE-284 GHSA-php4-mj74-f79r: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
OSV
Apache Tomcat Improper Access Control vulnerability
osv·2022-05-13·CVSS 9.8
CVE-2016-8735 [CRITICAL] Apache Tomcat Improper Access Control vulnerability
Apache Tomcat Improper Access Control vulnerability
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports.
The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
OSV
CVE-2016-8735: Remote code execution is possible with Apache Tomcat before 6
osv·2016-11-24·CVSS 9.8
CVE-2016-8735 [CRITICAL] CVE-2016-8735: Remote code execution is possible with Apache Tomcat before 6
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
OSV
openjdk-8 vulnerabilities
osv·2016-05-05·CVSS 9.6
CVE-2016-0686 [CRITICAL] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
Multiple vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service, expose sensitive data
over the network, or possibly execute arbitrary code. (CVE-2016-0686,
CVE-2016-0687, CVE-2016-3427)
Multiple vulnerabilities were discovered in the OpenJDK JRE related
to information disclosure. An attacker could exploit this to expose
sensitive data over the network. (CVE-2016-0695, CVE-2016-3426)
A vulnerability was discovered in the OpenJDK JRE related to availability.
An attacker could exploit this to cause a denial of service.
(CVE-2016-3425)
OSV
openjdk-7 vulnerabilities
osv·2016-05-05·CVSS 9.6
CVE-2016-0686 [CRITICAL] openjdk-7 vulnerabilities
openjdk-7 vulnerabilities
Multiple vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure, data integrity, and availability. An attacker could exploit
these to cause a denial of service, expose sensitive data over the network,
or possibly execute arbitrary code. (CVE-2016-0686, CVE-2016-0687,
CVE-2016-3427)
A vulnerability was discovered in the OpenJDK JRE related to information
disclosure. An attacker could exploit this to expose sensitive data over
the network. (CVE-2016-0695)
A vulnerability was discovered in the OpenJDK JRE related to availability.
An attacker could exploit this to cause a denial of service.
(CVE-2016-3425)
OSV
CVE-2016-3427: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28
osv·2016-04-21·CVSS 9.8
CVE-2016-3427 [CRITICAL] CVE-2016-3427: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
VulnCheck
Oracle Java SE and JRockit Unspecified Vulnerability
vulncheck·2016·CVSS 9.8
CVE-2016-3427 [CRITICAL] Oracle Java SE and JRockit Unspecified Vulnerability
Oracle Java SE and JRockit Unspecified Vulnerability
Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
Affected: Oracle Java SE and JRockit
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://thedfirreport.com/2023/12/18
VulnCheck
Apache Tomcat Remote Code Execution Vulnerability
vulncheck·2016·CVSS 9.8
CVE-2016-8735 [CRITICAL] CWE-284 Apache Tomcat Remote Code Execution Vulnerability
Apache Tomcat Remote Code Execution Vulnerability
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Affected: Apache Tomcat
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/
Remediation Due: 2023-06-02
CISA
Oracle Java SE and JRockit Unspecified Vulnerability
cisa·2023-05-12·CVSS 9.8
CVE-2016-3427 [CRITICAL] Oracle Java SE and JRockit Unspecified Vulnerability
Vulnerability: Oracle Java SE and JRockit Unspecified Vulnerability
Affected: Oracle Java SE and JRockit
Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
Required Action: Apply updates per vendor instructions.
Notes: https://www.oracle.com/security-alerts/cpuapr2016v3.html; https://nvd.nist.gov/vuln/detail/CVE-2016-3427
Remediation Due Dat
CISA
Apache Tomcat Remote Code Execution Vulnerability
cisa·2023-05-12·CVSS 9.8
CVE-2016-8735 [CRITICAL] CWE-284 Apache Tomcat Remote Code Execution Vulnerability
Vulnerability: Apache Tomcat Remote Code Execution Vulnerability
Affected: Apache Tomcat
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735
Remediation Due Date: 2023-06-02
Red Hat
tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
vendor_redhat·2016-11-22·CVSS 9.8
CVE-2016-8735 [CRITICAL] CWE-502 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on y
VMware
VMware product updates address critical and important security issues.
vendor_vmware·2016-05-17·CVSS 9.8
CVE-2016-2077 [CRITICAL] VMware product updates address critical and important security issues.
VMSA-2016-0005: VMware product updates address critical and important security issues.
a. Critical JMX issue when deserializing authentication credentials The RMI server of Oracle JRE JMX deserializes any class when deserializing authentication credentials. This may allow a remote, unauthenticated attacker to cause deserialization flaws and execute their commands. Workarounds CVE-2016-3427 vCenter Server Apply the steps of VMware Knowledge Base article 2145343 to vCenterServer 6.0 on Windows. See the table below for the specific vCenterServer 6.0 versions on Windows this applies to. vCloud Director No workaround identified vSphere Replication No workaround identified vRealize Operations Manager (non-appliance) The non-appliance version of vRealize Operations Manager (vROps), which can be
Ubuntu
OpenJDK 6 vulnerabilities
vendor_ubuntu·2016-05-10·CVSS 9.6
CVE-2016-0686 [CRITICAL] OpenJDK 6 vulnerabilities
Title: OpenJDK 6 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 6.
Multiple vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service, expose sensitive data
over the network, or possibly execute arbitrary code. (CVE-2016-0686,
CVE-2016-0687, CVE-2016-3427)
A vulnerability was discovered in the OpenJDK JRE related to information
disclosure. An attacker could exploit this to expose sensitive data over
the network. (CVE-2016-0695)
A vulnerability was discovered in the OpenJDK JRE related to availability.
An attacker could exploit this to cause a denial of service.
(CVE-2016-3425)
Instructions: This update uses a new upstream release, which inc
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2016-05-05·CVSS 9.6
CVE-2016-0686 [CRITICAL] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
Multiple vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity, and availability. An attacker
could exploit these to cause a denial of service, expose sensitive data
over the network, or possibly execute arbitrary code. (CVE-2016-0686,
CVE-2016-0687, CVE-2016-3427)
Multiple vulnerabilities were discovered in the OpenJDK JRE related
to information disclosure. An attacker could exploit this to expose
sensitive data over the network. (CVE-2016-0695, CVE-2016-3426)
A vulnerability was discovered in the OpenJDK JRE related to availability.
An attacker could exploit this to cause a denial of service.
(CVE-2016-3425)
Instructions: This update uses a new up
Ubuntu
OpenJDK 7 vulnerabilities
vendor_ubuntu·2016-05-05·CVSS 9.6
CVE-2016-0686 [CRITICAL] OpenJDK 7 vulnerabilities
Title: OpenJDK 7 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 7.
Multiple vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure, data integrity, and availability. An attacker could exploit
these to cause a denial of service, expose sensitive data over the network,
or possibly execute arbitrary code. (CVE-2016-0686, CVE-2016-0687,
CVE-2016-3427)
A vulnerability was discovered in the OpenJDK JRE related to information
disclosure. An attacker could exploit this to expose sensitive data over
the network. (CVE-2016-0695)
A vulnerability was discovered in the OpenJDK JRE related to availability.
An attacker could exploit this to cause a denial of service.
(CVE-2016-3425)
Instructions: This update uses a new upstream release, which inc
Red Hat
OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
vendor_redhat·2016-04-19·CVSS 9.8
CVE-2016-3427 [CRITICAL] OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws.
Debian
CVE-2016-8735: tomcat9 - Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7...
vendor_debian·2016·CVSS 9.8
CVE-2016-8735 [CRITICAL] CVE-2016-8735: tomcat9 - Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7...
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2016-3427: openjdk-8 - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embed...
vendor_debian·2016·CVSS 9.8
CVE-2016-3427 [CRITICAL] CVE-2016-3427: openjdk-8 - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embed...
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Scope: local
sid: resolved (fixed in 8u91-b14-1)
Apache
Apache tomcat: CVE-2016-3427
vendor_apache·CVSS 9.8
CVE-2016-3427 [HIGH] Apache tomcat: CVE-2016-3427
Apache tomcat: CVE-2016-3427
. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used. This was fixed in revision 1767656 . This issue was reported to the Apache Tomcat Security Team on 19 October 2016 and made public on 22 November 2016. Affects: 8.0.0.RC1 to 8.0.38 Important: Information Disclosure
Severity: high
No detection rules found.
Nuclei
Apache Tomcat - Remote Code Execution via JMX Ports
nuclei·CVSS 9.8
CVE-2016-8735 [CRITICAL] Apache Tomcat - Remote Code Execution via JMX Ports
Apache Tomcat - Remote Code Execution via JMX Ports
Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 are vulnerable to remote code execution if JmxRemoteLifecycleListener is used and the JMX ports are exposed to attackers. The vulnerability exists due to inconsistent credential type handling, which was not aligned with the CVE-2016-3427 Oracle patch. Attackers with access to JMX ports can exploit this issue to execute arbitrary code remotely.
Template:
id: CVE-2016-8735
info:
name: Apache Tomcat - Remote Code Execution via JMX Ports
author: hnd3884
severity: critical
description: |
Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 are vulnerable
Bugzilla
CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
bugzilla·2016-11-22·CVSS 9.8
CVE-2016-8735 [CRITICAL] CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http:/
Bugzilla
CVE-2016-3427 OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
bugzilla·2016-04-18·CVSS 9.8
CVE-2016-3427 [CRITICAL] CVE-2016-3427 OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
CVE-2016-3427 OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
It was discovered that the RMI (Java Remote Method Invocation) server implementation in the JMX (Java Management Extensions) component of OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote unauthenticated attacker able to connect to a JMX port could possibly use this flaw trigger deserialization flaws.
Discussion:
Related note in Oracle JDK release notes:
New attribute for JMX RMI JRMP servers specifies a list of class names to
use when deserializing server credentials
A new java attribute has been defined for the environment to allow a JMX
RMI JRMP server to specify a list of class names. These names correspond
to the closure
Dfir Report
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity
blogs_dfir_report·2023-12-18
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0650.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0651.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0676.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0677.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0678.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0679.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0701.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0702.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0708.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0716.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0723.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1039.htmlhttp://www.debian.org/security/2016/dsa-3558http://www.openwall.com/lists/oss-security/2020/08/31/1http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/86421http://www.securitytracker.com/id/1035596http://www.securitytracker.com/id/1037331http://www.ubuntu.com/usn/USN-2963-1http://www.ubuntu.com/usn/USN-2964-1http://www.ubuntu.com/usn/USN-2972-1https://access.redhat.com/errata/RHSA-2016:1430https://access.redhat.com/errata/RHSA-2017:1216https://kc.mcafee.com/corporate/index?page=content&id=SB10159https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r5f48b16573a11fdf0b557cc3d1d71423ecde8ee771c29f32334fa948%40%3Cdev.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rc3abf40b06c511d5693baf707d6444bf7745e6a1e343e6f530a12258%40%3Cuser.cassandra.apache.org%3Ehttps://security.gentoo.org/glsa/201606-18https://security.netapp.com/advisory/ntap-20160420-0001/http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0650.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0651.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0675.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0676.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0677.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0678.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0679.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0701.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0702.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0708.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0716.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0723.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1039.htmlhttp://www.debian.org/security/2016/dsa-3558http://www.openwall.com/lists/oss-security/2020/08/31/1http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/86421http://www.securitytracker.com/id/1035596http://www.securitytracker.com/id/1037331http://www.ubuntu.com/usn/USN-2963-1http://www.ubuntu.com/usn/USN-2964-1http://www.ubuntu.com/usn/USN-2972-1https://access.redhat.com/errata/RHSA-2016:1430https://access.redhat.com/errata/RHSA-2017:1216https://kc.mcafee.com/corporate/index?page=content&id=SB10159
+ 19 more references
2016-04-21
Published
2023-05-12
Added to CISA KEV
Exploited in the wild