9.8

CVE-2017-5878

The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Red5 ≫ Media Server Version 1.0.2 Update -
Red5 ≫ Media Server Version 1.0.2 Update milestone1
Red5 ≫ Media Server Version 1.0.3
Red5 ≫ Media Server Version 1.0.4
Red5 ≫ Media Server Version 1.0.5
Red5 ≫ Media Server Version 1.0.6
Red5 ≫ Media Server Version 1.0.7 Update -
Red5 ≫ Media Server Version 1.0.7 Update milestone1
Red5 ≫ Media Server Version 1.0.7 Update milestone2
Red5 ≫ Media Server Version 1.0.7 Update milestone3
Red5 ≫ Media Server Version 1.0.7 Update milestone4
Red5 ≫ Media Server Version 1.0.7 Update milestone5
Red5 ≫ Media Server Version 1.0.7 Update milestone6
Red5 ≫ Media Server Version 1.0.7 Update milestone7
Red5 ≫ Media Server Version 1.0.8 Update milestone1
Red5 ≫ Media Server Version 1.0.8 Update milestone10
Red5 ≫ Media Server Version 1.0.8 Update milestone11
Red5 ≫ Media Server Version 1.0.8 Update milestone12
Red5 ≫ Media Server Version 1.0.8 Update milestone13
Red5 ≫ Media Server Version 1.0.8 Update milestone2
Red5 ≫ Media Server Version 1.0.8 Update milestone3
Red5 ≫ Media Server Version 1.0.8 Update milestone4
Red5 ≫ Media Server Version 1.0.8 Update milestone5
Red5 ≫ Media Server Version 1.0.8 Update milestone6
Red5 ≫ Media Server Version 1.0.8 Update milestone7
Red5 ≫ Media Server Version 1.0.8 Update milestone8
Red5 ≫ Media Server Version 1.0.8 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.72% 0.841
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

http://www.openwall.com/lists/oss-security/2017/05/22/2
Third Party Advisory
Mailing List
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Third Party Advisory