Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9
CVSSv3

CVE-2016-3427

Published: 21/04/2016 Updated: 07/11/2023
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 9 | Impact Score: 6 | Exploitability Score: 2.2
VMScore: 893
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Jrockit

Vulnerability Summary

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote malicious users to affect confidentiality, integrity, and availability via vectors related to JMX.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

oracle jrockit r28.3.9

oracle jdk 1.8.0

oracle jdk 1.6.0

oracle jdk 1.7.0

oracle jre 1.6.0

oracle jre 1.7.0

oracle jre 1.8.0

Vendor Advisories

Red Hat: Important: Red Hat JBoss Web Server security and enhancement update
Synopsis Important: Red Hat JBoss Web Server security and enhancement update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web ServerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System ...
Red Hat: Moderate: java-1.7.1-ibm security update
Synopsis Moderate: java-171-ibm security update Type/Severity Security Advisory: Moderate Topic An update for java-171-ibm is now available for Red HatSatellite 57 and Red Hat Satellite 56Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Sc ...
Debian CVElist Bug Report Logs: CVE-2016-9774: privilege escalation via upgrade
Debian Bug report logs - #845393 CVE-2016-9774: privilege escalation via upgrade Package: tomcat8; Maintainer for tomcat8 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for tomcat8 is src:tomcat8 (PTS, buildd, popcon) Reported by: Paul Szabo <paulszabo@sydneyeduau> Date: Tue, 22 ...
Debian CVElist Bug Report Logs: CVE-2016-9775: privilege escalation via removal
Debian Bug report logs - #845385 CVE-2016-9775: privilege escalation via removal Package: tomcat8; Maintainer for tomcat8 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for tomcat8 is src:tomcat8 (PTS, buildd, popcon) Reported by: Paul Szabo <paulszabo@sydneyeduau> Date: Tue, 22 ...
Debian Security Advisories: DSA-3558-1 openjdk-7 -- security update
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in breakouts of the Java sandbox, denial of service or information disclosure For the stable distribution (jessie), these problems have been fixed in version 7u101-266-1~deb8u1 We recommend that you upgrade your openjdk-7 packages ...
Ubuntu Security Notice: openjdk-7 vulnerabilities
Several security issues were fixed in OpenJDK 7 ...
Ubuntu Security Notice: openjdk-8 vulnerabilities
Several security issues were fixed in OpenJDK 8 ...
Ubuntu Security Notice: openjdk-6 vulnerabilities
Several security issues were fixed in OpenJDK 6 ...
Amazon Linux AMI: ALAS-2016-700
Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions (CVE-2016-0686, CVE-2016-0687) It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be ...
Amazon Linux AMI: ALAS-2016-688
It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions (CVE-2016-0686) It was discovered that the Hotspot component of OpenJDK did no ...
Amazon Linux AMI: ALAS-2016-693
It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions (CVE-2016-0686) It was discovered that the Hotspot component of OpenJDK did no ...
Red Hat: CVE-2016-3427
It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws ...

Github Repositories

https://github.com/gyanaa/https-github.com-joaomatosf-jexboss

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/qashqao/jexboss

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/joaomatosf/jexboss

JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/QChiLan/jexboss

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/milkdevil/jexboss

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/bibortone/Jexboss

JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/syadg123/exboss

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc Requirements Python >= 27x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the

https://github.com/qtc-de/remote-method-guesser

Java RMI Vulnerability Scanner

Remote Method Guesser remote-method-guesser (rmg) is a Java RMI vulnerability scanner and can be used to identify and verify common security vulnerabilities on Java RMI endpoints

https://github.com/r00t4dm/hackfest-2016

Fixing the Java Serialization mess Supporting source code for a HackFest 2016 presentation Installation mvn install Content POC for CVE-2016-3427 Class comsalesforcetrusts11nexploitJmxClient Tries to: Connect to the provided JMX server using the long connection string syntax Connect to the provided JMX server using the RMI connectio

https://github.com/EphraimMayer/remote-method-guesser

Remote Method Guesser remote-method-guesser# (!rmg*) is a Java RMI vulnerability scanner and can be used to identify and verify common security vulnerabilities on Java RMI endpoints

References

NVD-CWE-noinfohttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0702.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0701.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0723.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0708.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0716.htmlhttps://security.gentoo.org/glsa/201606-18http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttps://access.redhat.com/errata/RHSA-2016:1430http://www.securityfocus.com/bid/86421http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1039.htmlhttps://kc.mcafee.com/corporate/index?page=content&id=SB10159http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0676.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0675.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0679.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0677.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0678.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0651.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0650.htmlhttp://www.ubuntu.com/usn/USN-2972-1http://www.ubuntu.com/usn/USN-2963-1http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.htmlhttp://www.ubuntu.com/usn/USN-2964-1http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.htmlhttp://www.debian.org/security/2016/dsa-3558http://www.securitytracker.com/id/1035596http://www.securitytracker.com/id/1037331https://security.netapp.com/advisory/ntap-20160420-0001/https://access.redhat.com/errata/RHSA-2017:1216http://www.openwall.com/lists/oss-security/2020/08/31/1https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rc3abf40b06c511d5693baf707d6444bf7745e6a1e343e6f530a12258%40%3Cuser.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r5f48b16573a11fdf0b557cc3d1d71423ecde8ee771c29f32334fa948%40%3Cdev.cassandra.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2017:0457https://nvd.nist.govhttps://usn.ubuntu.com/2964-1/https://www.debian.org/security/./dsa-3558
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27977IMAPlocal usersCVE-2024-32038CVE-2023-49963CVE-2023-22869CVE-2024-31497localCVE-2024-2961
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook