Vulnerabilites related to adobe - lifecycle
var-201106-0116
Vulnerability from variot
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a denial of service via unspecified vectors, related to a "complex object graph vulnerability.". (DoS) There is a vulnerability that becomes a condition.Denial of service by attacker (DoS) There is a possibility of being put into a state. Adobe LiveCycle Data Services and BlazeDS are prone to a remote denial-of-service vulnerability. Remote attackers can exploit this issue to crash the affected applications, denying service to legitimate users. ----------------------------------------------------------------------
Join Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria See to the presentation "The Dynamics and Threats of End-Point Software Portfolios" by Secunia's Research Analyst Director, Stefan Frei. Read more: http://conference.first.org/
TITLE: Adobe LiveCycle / BlazeDS Two Vulnerabilities
SECUNIA ADVISORY ID: SA44922
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44922/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44922
RELEASE DATE: 2011-06-15
DISCUSS ADVISORY: http://secunia.com/advisories/44922/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/44922/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=44922
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Two vulnerabilities have been reported in Adobe LiveCycle and BlazeDS, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.
1) An error when handling AMF/AMFX data during object deserialization can be exploited to execute certain class methods.
Successful exploitation may allow execution of arbitrary code.
2) An error when processing certain graph objects (e.g. JFrame class) can be exploited to cause a DoS.
The vulnerabilities are reported in the following products: * LiveCycle Data Services 3.1, 2.6.1, 2.5.1, and earlier for Windows, Macintosh, and UNIX. * LiveCycle 9.0.0.2, 8.2.1.3, 8.0.1.3, and earlier for Windows, Linux, and UNIX. * BlazeDS 4.0.1 and earlier.
SOLUTION: Apply updates (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY: Wouter Coekaerts
ORIGINAL ADVISORY: Adobe (APSB11-15): http://www.adobe.com/support/security/bulletins/apsb11-15.html
Wouter Coekaerts: http://wouter.coekaerts.be/2011/amf-arbitrary-code-execution
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
1) The administrative interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. add a user with administrative privileges by tricking the logged in administrator into visiting a malicious web site. No further information is currently available.
3) Some vulnerabilities are caused due to vulnerabilities in the bundled version of Adobe BlazeDS
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201106-0116",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "6.0"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "7.0"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.2.1.3"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "2.6.1"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.0.1.2"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.0.1"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.0.1.1"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "2.5"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "2.6"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "3"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "2.5.1"
},
{
"model": "blazeds",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "4.0.1"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "9.0.0.2"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "3.1"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "3.1 and earlier for windows"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "9.0.0.2 and earlier for windows"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "2.6.1 and earlier for windows"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "blazeds",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "4.0.1 and earlier"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "linux unix"
},
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "macintosh unix"
},
{
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "2.5.1 and earlier for windows"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "8.2.1.3 and earlier for windows"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "8.0.1.3 and earlier for windows"
},
{
"model": "tiered storage manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "9.0.0.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0.0.96"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"model": "systems insight manager update",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.31"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.3"
},
{
"model": "systems insight manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.2"
},
{
"model": "systems insight manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.1"
},
{
"model": "systems insight manager sp6",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp5",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.2"
},
{
"model": "systems insight manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.2"
},
{
"model": "lifecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.6.1"
},
{
"model": "lifecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "3.1"
},
{
"model": "lifecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.5.1"
},
{
"model": "lifecycle",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.0.2"
},
{
"model": "lifecycle",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "8.2.1.3"
},
{
"model": "lifecycle",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "8.0.1.3"
},
{
"model": "blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "4.0.1"
},
{
"model": "blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "4.0"
},
{
"model": "systems insight manager",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
}
],
"sources": [
{
"db": "BID",
"id": "48267"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.0.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.0.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.2.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.0.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2093"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Wouter Coekaerts",
"sources": [
{
"db": "BID",
"id": "48267"
}
],
"trust": 0.3
},
"cve": "CVE-2011-2093",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2011-2093",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-2093",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201106-174",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly handle object graphs, which allows attackers to cause a denial of service via unspecified vectors, related to a \"complex object graph vulnerability.\". (DoS) There is a vulnerability that becomes a condition.Denial of service by attacker (DoS) There is a possibility of being put into a state. Adobe LiveCycle Data Services and BlazeDS are prone to a remote denial-of-service vulnerability. \nRemote attackers can exploit this issue to crash the affected applications, denying service to legitimate users. ----------------------------------------------------------------------\n\n\nJoin Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria\nSee to the presentation \"The Dynamics and Threats of End-Point Software Portfolios\" by Secunia\u0027s Research Analyst Director, Stefan Frei. \nRead more:\nhttp://conference.first.org/ \n\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe LiveCycle / BlazeDS Two Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA44922\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/44922/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44922\n\nRELEASE DATE:\n2011-06-15\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/44922/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/44922/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44922\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nTwo vulnerabilities have been reported in Adobe LiveCycle and\nBlazeDS, which can be exploited by malicious people to cause a DoS\n(Denial of Service) and compromise a vulnerable system. \n\n1) An error when handling AMF/AMFX data during object deserialization\ncan be exploited to execute certain class methods. \n\nSuccessful exploitation may allow execution of arbitrary code. \n\n2) An error when processing certain graph objects (e.g. JFrame class)\ncan be exploited to cause a DoS. \n\nThe vulnerabilities are reported in the following products:\n* LiveCycle Data Services 3.1, 2.6.1, 2.5.1, and earlier for Windows,\nMacintosh, and UNIX. \n* LiveCycle 9.0.0.2, 8.2.1.3, 8.0.1.3, and earlier for Windows,\nLinux, and UNIX. \n* BlazeDS 4.0.1 and earlier. \n\nSOLUTION:\nApply updates (please see the vendor\u0027s advisory for details). \n\nPROVIDED AND/OR DISCOVERED BY:\nWouter Coekaerts\n\nORIGINAL ADVISORY:\nAdobe (APSB11-15):\nhttp://www.adobe.com/support/security/bulletins/apsb11-15.html\n\nWouter Coekaerts:\nhttp://wouter.coekaerts.be/2011/amf-arbitrary-code-execution\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n1) The administrative interface allows users to perform certain\nactions via HTTP requests without performing any validity checks to\nverify the requests. This can be exploited to e.g. add a user with\nadministrative privileges by tricking the logged in administrator\ninto visiting a malicious web site. No further\ninformation is currently available. \n\n3) Some vulnerabilities are caused due to vulnerabilities in the\nbundled version of Adobe BlazeDS",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "BID",
"id": "48267"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-2093",
"trust": 2.7
},
{
"db": "BID",
"id": "48267",
"trust": 1.3
},
{
"db": "OSVDB",
"id": "73009",
"trust": 1.0
},
{
"db": "SECTRACK",
"id": "1025656",
"trust": 1.0
},
{
"db": "SECTRACK",
"id": "1025657",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001778",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "44922",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "43013",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "17048",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "17130",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201106-174",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "102306",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "102313",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "48267"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
},
{
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"id": "VAR-201106-0116",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.18666667
},
"last_update_date": "2023-12-18T12:10:42.114000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB11-15",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb11-15.html"
},
{
"title": "APSB11-15",
"trust": 0.8,
"url": "http://www.adobe.com/jp/support/security/bulletins/apsb11-15.html"
},
{
"title": "HS12-018",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-018/index.html"
},
{
"title": "HS12-011",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-011/index.html"
},
{
"title": "HS12-014",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-014/index.html"
},
{
"title": "HPSBMU02769 SSRT100846",
"trust": 0.8,
"url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03298151"
},
{
"title": "HS12-018",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-018/index.html"
},
{
"title": "HS12-011",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-011/index.html"
},
{
"title": "HS12-014",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-014/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "NVD",
"id": "CVE-2011-2093"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.adobe.com/support/security/bulletins/apsb11-15.html"
},
{
"trust": 1.0,
"url": "http://osvdb.org/73009"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/48267"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1025656"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1025657"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68026"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2093"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2093"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/43013"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/44922"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/17130"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/17048"
},
{
"trust": 0.3,
"url": "http://www.adobe.com"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://conference.first.org/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44922"
},
{
"trust": 0.1,
"url": "http://wouter.coekaerts.be/2011/amf-arbitrary-code-execution"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44922/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44922/#comments"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb11-14.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43013/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=43013"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43013/#comments"
}
],
"sources": [
{
"db": "BID",
"id": "48267"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
},
{
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "48267"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
},
{
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-14T00:00:00",
"db": "BID",
"id": "48267"
},
{
"date": "2011-06-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"date": "2011-06-16T02:14:36",
"db": "PACKETSTORM",
"id": "102306"
},
{
"date": "2011-06-16T02:14:54",
"db": "PACKETSTORM",
"id": "102313"
},
{
"date": "2011-06-16T23:55:01.557000",
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"date": "2011-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-01T17:21:00",
"db": "BID",
"id": "48267"
},
{
"date": "2013-03-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001778"
},
{
"date": "2017-08-29T01:29:16.253000",
"db": "NVD",
"id": "CVE-2011-2093"
},
{
"date": "2011-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Adobe Service disruption in products (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001778"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201106-174"
}
],
"trust": 0.6
}
}
var-201106-0115
Vulnerability from variot
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability.". BlazeDS and GraniteDS are prone to a remote code-execution vulnerability. Successful exploits will allow attackers to execute arbitrary code within the context of the affected application. Remote attackers can exploit this issue to bypass certain security restrictions. NOTE: This issue was previously discussed in BID 48267 (Adobe LiveCycle Data Services and BlazeDS APSB11-15 Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------
Join Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria See to the presentation "The Dynamics and Threats of End-Point Software Portfolios" by Secunia's Research Analyst Director, Stefan Frei. Read more: http://conference.first.org/
TITLE: Adobe LiveCycle / BlazeDS Two Vulnerabilities
SECUNIA ADVISORY ID: SA44922
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44922/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44922
RELEASE DATE: 2011-06-15
DISCUSS ADVISORY: http://secunia.com/advisories/44922/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/44922/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=44922
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Two vulnerabilities have been reported in Adobe LiveCycle and BlazeDS, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.
1) An error when handling AMF/AMFX data during object deserialization can be exploited to execute certain class methods.
2) An error when processing certain graph objects (e.g. JFrame class) can be exploited to cause a DoS.
The vulnerabilities are reported in the following products: * LiveCycle Data Services 3.1, 2.6.1, 2.5.1, and earlier for Windows, Macintosh, and UNIX. * LiveCycle 9.0.0.2, 8.2.1.3, 8.0.1.3, and earlier for Windows, Linux, and UNIX. * BlazeDS 4.0.1 and earlier.
SOLUTION: Apply updates (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY: Wouter Coekaerts
ORIGINAL ADVISORY: Adobe (APSB11-15): http://www.adobe.com/support/security/bulletins/apsb11-15.html
Wouter Coekaerts: http://wouter.coekaerts.be/2011/amf-arbitrary-code-execution
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
1) The administrative interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. add a user with administrative privileges by tricking the logged in administrator into visiting a malicious web site. No further information is currently available.
3) Some vulnerabilities are caused due to vulnerabilities in the bundled version of Adobe BlazeDS
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201106-0115",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "6.0"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "7.0"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.2.1.3"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "2.6.1"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.0.1.2"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.0.1"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "8.0.1.1"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "2.5"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.6,
"vendor": "adobe",
"version": "2.6"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "3"
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 1.0,
"vendor": "adobe",
"version": "2.5.1"
},
{
"model": "blazeds",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "4.0.1"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "9.0.0.2"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 1.0,
"vendor": "adobe",
"version": "3.1"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "3.1 and earlier for windows"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "9.0.0.2 and earlier for windows"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "2.6.1 and earlier for windows"
},
{
"model": "jp1/it desktop management",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- manager"
},
{
"model": "blazeds",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "4.0.1 and earlier"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "linux unix"
},
{
"model": "it operations director",
"scope": null,
"trust": 0.8,
"vendor": "hitachi",
"version": null
},
{
"model": "livecycle data services",
"scope": "eq",
"trust": 0.8,
"vendor": "adobe",
"version": "macintosh unix"
},
{
"model": "device manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "livecycle data services",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "2.5.1 and earlier for windows"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "8.2.1.3 and earlier for windows"
},
{
"model": "livecycle",
"scope": "lte",
"trust": 0.8,
"vendor": "adobe",
"version": "8.0.1.3 and earlier for windows"
},
{
"model": "tiered storage manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "software"
},
{
"model": "livecycle",
"scope": "eq",
"trust": 0.6,
"vendor": "adobe",
"version": "9.0.0.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.3"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0.0.96"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"model": "systems insight manager update",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.31"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.3"
},
{
"model": "systems insight manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.2"
},
{
"model": "systems insight manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.1"
},
{
"model": "systems insight manager sp6",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp5",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0"
},
{
"model": "systems insight manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.2"
},
{
"model": "systems insight manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.2"
},
{
"model": "systems insight manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.2"
},
{
"model": "software graniteds",
"scope": "eq",
"trust": 0.3,
"vendor": "granite",
"version": "2.2"
},
{
"model": "lifecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.6.1"
},
{
"model": "lifecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "3.1"
},
{
"model": "lifecycle data services",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "2.5.1"
},
{
"model": "lifecycle",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "9.0.0.2"
},
{
"model": "lifecycle",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "8.2.1.3"
},
{
"model": "lifecycle",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "8.0.1.3"
},
{
"model": "blazeds",
"scope": "eq",
"trust": 0.3,
"vendor": "adobe",
"version": "4.0.1"
},
{
"model": "systems insight manager",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
},
{
"model": "software graniteds",
"scope": "ne",
"trust": 0.3,
"vendor": "granite",
"version": "2.2.1"
}
],
"sources": [
{
"db": "BID",
"id": "48279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.0.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle_data_services:2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.0.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.0.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:8.2.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:adobe:livecycle:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2092"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Wouter Coekaerts",
"sources": [
{
"db": "BID",
"id": "48279"
}
],
"trust": 0.3
},
"cve": "CVE-2011-2092",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2011-2092",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-2092",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201106-172",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a \"deserialization vulnerability.\". BlazeDS and GraniteDS are prone to a remote code-execution vulnerability. \nSuccessful exploits will allow attackers to execute arbitrary code within the context of the affected application. \nRemote attackers can exploit this issue to bypass certain security restrictions. \nNOTE: This issue was previously discussed in BID 48267 (Adobe LiveCycle Data Services and BlazeDS APSB11-15 Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------\n\n\nJoin Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria\nSee to the presentation \"The Dynamics and Threats of End-Point Software Portfolios\" by Secunia\u0027s Research Analyst Director, Stefan Frei. \nRead more:\nhttp://conference.first.org/ \n\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe LiveCycle / BlazeDS Two Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA44922\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/44922/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44922\n\nRELEASE DATE:\n2011-06-15\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/44922/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/44922/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44922\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nTwo vulnerabilities have been reported in Adobe LiveCycle and\nBlazeDS, which can be exploited by malicious people to cause a DoS\n(Denial of Service) and compromise a vulnerable system. \n\n1) An error when handling AMF/AMFX data during object deserialization\ncan be exploited to execute certain class methods. \n\n2) An error when processing certain graph objects (e.g. JFrame class)\ncan be exploited to cause a DoS. \n\nThe vulnerabilities are reported in the following products:\n* LiveCycle Data Services 3.1, 2.6.1, 2.5.1, and earlier for Windows,\nMacintosh, and UNIX. \n* LiveCycle 9.0.0.2, 8.2.1.3, 8.0.1.3, and earlier for Windows,\nLinux, and UNIX. \n* BlazeDS 4.0.1 and earlier. \n\nSOLUTION:\nApply updates (please see the vendor\u0027s advisory for details). \n\nPROVIDED AND/OR DISCOVERED BY:\nWouter Coekaerts\n\nORIGINAL ADVISORY:\nAdobe (APSB11-15):\nhttp://www.adobe.com/support/security/bulletins/apsb11-15.html\n\nWouter Coekaerts:\nhttp://wouter.coekaerts.be/2011/amf-arbitrary-code-execution\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n1) The administrative interface allows users to perform certain\nactions via HTTP requests without performing any validity checks to\nverify the requests. This can be exploited to e.g. add a user with\nadministrative privileges by tricking the logged in administrator\ninto visiting a malicious web site. No further\ninformation is currently available. \n\n3) Some vulnerabilities are caused due to vulnerabilities in the\nbundled version of Adobe BlazeDS",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "BID",
"id": "48279"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-2092",
"trust": 2.7
},
{
"db": "SECTRACK",
"id": "1025656",
"trust": 1.0
},
{
"db": "SECTRACK",
"id": "1025657",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001777",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "44922",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "43013",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "17048",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "19537",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201106-172",
"trust": 0.6
},
{
"db": "BID",
"id": "48279",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "102306",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "102313",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "48279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
},
{
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"id": "VAR-201106-0115",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.18666667
},
"last_update_date": "2023-12-18T12:10:42.183000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APSB11-15",
"trust": 0.8,
"url": "http://www.adobe.com/support/security/bulletins/apsb11-15.html"
},
{
"title": "APSB11-15",
"trust": 0.8,
"url": "http://www.adobe.com/jp/support/security/bulletins/apsb11-15.html"
},
{
"title": "HS12-018",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-018/index.html"
},
{
"title": "HS12-011",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-011/index.html"
},
{
"title": "HS12-014",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-014/index.html"
},
{
"title": "HPSBMU02769 SSRT100846",
"trust": 0.8,
"url": "http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03298151"
},
{
"title": "HS12-018",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-018/index.html"
},
{
"title": "HS12-011",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-011/index.html"
},
{
"title": "HS12-014",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs12-014/index.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "NVD",
"id": "CVE-2011-2092"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.adobe.com/support/security/bulletins/apsb11-15.html"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1025656"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1025657"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2092"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2092"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/43013"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/44922"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/17048"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19537"
},
{
"trust": 0.3,
"url": "http://www.adobe.com"
},
{
"trust": 0.3,
"url": "http://www.granitedataservices.com/granite-data-services-2-2-1-ga-released/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://conference.first.org/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44922"
},
{
"trust": 0.1,
"url": "http://wouter.coekaerts.be/2011/amf-arbitrary-code-execution"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44922/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44922/#comments"
},
{
"trust": 0.1,
"url": "http://www.adobe.com/support/security/bulletins/apsb11-14.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43013/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=43013"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43013/#comments"
}
],
"sources": [
{
"db": "BID",
"id": "48279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
},
{
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "48279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"db": "PACKETSTORM",
"id": "102306"
},
{
"db": "PACKETSTORM",
"id": "102313"
},
{
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-14T00:00:00",
"db": "BID",
"id": "48279"
},
{
"date": "2011-06-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"date": "2011-06-16T02:14:36",
"db": "PACKETSTORM",
"id": "102306"
},
{
"date": "2011-06-16T02:14:54",
"db": "PACKETSTORM",
"id": "102313"
},
{
"date": "2011-06-16T23:55:01.527000",
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"date": "2011-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-01T17:21:00",
"db": "BID",
"id": "48279"
},
{
"date": "2013-03-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001777"
},
{
"date": "2011-09-07T03:16:56.270000",
"db": "NVD",
"id": "CVE-2011-2092"
},
{
"date": "2011-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Adobe Unknown vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001777"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201106-172"
}
],
"trust": 0.6
}
}
cve-2009-3960
Vulnerability from cvelistv5
Published
2010-02-15 18:00
Modified
2024-08-07 06:45
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/38197 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/id?1023584 | vdb-entry, x_refsource_SECTRACK | |
| http://www.osvdb.org/62292 | vdb-entry, x_refsource_OSVDB | |
| http://secunia.com/advisories/38543 | third-party-advisory, x_refsource_SECUNIA | |
| https://www.exploit-db.com/exploits/41855/ | exploit, x_refsource_EXPLOIT-DB | |
| http://www.adobe.com/support/security/bulletins/apsb10-05.html | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:45:50.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38197",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/38197"
},
{
"name": "1023584",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1023584"
},
{
"name": "62292",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/62292"
},
{
"name": "38543",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/38543"
},
{
"name": "41855",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41855/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-05.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-02-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-15T09:57:01",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"name": "38197",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/38197"
},
{
"name": "1023584",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1023584"
},
{
"name": "62292",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/62292"
},
{
"name": "38543",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/38543"
},
{
"name": "41855",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/41855/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-05.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@adobe.com",
"ID": "CVE-2009-3960",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38197",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/38197"
},
{
"name": "1023584",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1023584"
},
{
"name": "62292",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/62292"
},
{
"name": "38543",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/38543"
},
{
"name": "41855",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/41855/"
},
{
"name": "http://www.adobe.com/support/security/bulletins/apsb10-05.html",
"refsource": "CONFIRM",
"url": "http://www.adobe.com/support/security/bulletins/apsb10-05.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2009-3960",
"datePublished": "2010-02-15T18:00:00",
"dateReserved": "2009-11-16T00:00:00",
"dateUpdated": "2024-08-07T06:45:50.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2010-02-15 18:30
Modified
2024-12-19 18:09
Severity ?
Summary
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| adobe | blazeds | * | |
| adobe | coldfusion | 7.0.2 | |
| adobe | coldfusion | 8.0 | |
| adobe | coldfusion | 8.0.1 | |
| adobe | coldfusion | 9.0 | |
| adobe | flex_data_services | 2.0.1 | |
| adobe | lifecycle | 8.0.1 | |
| adobe | lifecycle | 8.2.1 | |
| adobe | lifecycle | 9.0 | |
| adobe | lifecycle_data_services | 2.5.1 | |
| adobe | lifecycle_data_services | 2.6.1 | |
| adobe | lifecycle_data_services | 3.0 |
{
"cisaActionDue": "2022-09-07",
"cisaExploitAdd": "2022-03-07",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Adobe BlazeDS Information Disclosure Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:blazeds:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF7C97E-BE99-415D-B12B-D3E7BD9EDF08",
"versionEndIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B015715F-9672-480E-B0AA-968D8C9070D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DD6C1877-7412-4FBE-9641-334971F9D153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "28C8D6AF-EDE1-42BD-A47C-2EF8690299BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:coldfusion:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "113431FB-E4BE-4416-800C-6B13AD1C0E92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flex_data_services:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B6F65E3F-F3E7-4BE9-A13B-87FFF3B3777E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:lifecycle:8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2A1EAAD5-7A00-4EC3-9F97-D2965E2569D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:lifecycle:8.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D227BD60-5882-4C73-A642-EEE1E485FC48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:lifecycle:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3824D1B3-CE8E-488C-B241-BBD764C935F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:lifecycle_data_services:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EDF0B56D-E982-44CE-92E8-DA696E33717A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:lifecycle_data_services:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "18CBBE17-8E63-4A48-997B-850702442394",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:lifecycle_data_services:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3080073F-5BF3-415D-917A-C04DDCEEB311",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents."
},
{
"lang": "es",
"value": "Vulnerabilidad sin especificar en BlazeDS v3.2 y anteriores, tal como es utilizado en LiveCycle v8.0.1, v8.2.1 y v9.0, LiveCycle Data Services v2.5.1, v2.6.1 y v3.0, Flex Data Services v2.0.1 y ColdFusion v7.0.2, v8.0, v8.0.1 y v9.0. Permite a atacantes remotos obtener informaci\u00f3n confidencial a trav\u00e9s de vectores de ataque asociados con una petici\u00f3n, y relacionados con una etiqueta inyectada y una referencia a una entidad externa en documentos XML."
}
],
"id": "CVE-2009-3960",
"lastModified": "2024-12-19T18:09:00.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2010-02-15T18:30:00.407",
"references": [
{
"source": "psirt@adobe.com",
"tags": [
"Broken Link"
],
"url": "http://secunia.com/advisories/38543"
},
{
"source": "psirt@adobe.com",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1023584"
},
{
"source": "psirt@adobe.com",
"tags": [
"Not Applicable",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-05.html"
},
{
"source": "psirt@adobe.com",
"tags": [
"Broken Link"
],
"url": "http://www.osvdb.org/62292"
},
{
"source": "psirt@adobe.com",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/38197"
},
{
"source": "psirt@adobe.com",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/41855/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://secunia.com/advisories/38543"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://securitytracker.com/id?1023584"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb10-05.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.osvdb.org/62292"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/38197"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/41855/"
}
],
"sourceIdentifier": "psirt@adobe.com",
"vulnStatus": "Undergoing Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}