NVD脆弱性詳細

CVE-2015-7501

概要	Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
公表日	2017年11月10日2:29
登録日	2021年1月26日14:56
最終更新日	2024年11月21日11:36

CVSS3.0 : CRITICAL
スコア	9.8
ベクター	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
スコア	10.0
ベクター	AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:redhat:jboss_operations_network:3.0:::::::*
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:::::::*
cpe:2.3:a:redhat:openshift:3.0::::enterprise:::
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:::::::*
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:::::::*
cpe:2.3:a:redhat:jboss_portal:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:::::::*
cpe:2.3:a:redhat:xpaas:3.0.0:::::::*
cpe:2.3:a:redhat:data_grid:6.0.0:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://rhn.redhat.com/errata/RHSA-2015-2500.html
2	http://rhn.redhat.com/errata/RHSA-2015-2500.html
3	http://rhn.redhat.com/errata/RHSA-2015-2501.html
4	http://rhn.redhat.com/errata/RHSA-2015-2501.html
5	http://rhn.redhat.com/errata/RHSA-2015-2502.html
6	http://rhn.redhat.com/errata/RHSA-2015-2502.html
7	http://rhn.redhat.com/errata/RHSA-2015-2514.html
8	http://rhn.redhat.com/errata/RHSA-2015-2514.html
9	http://rhn.redhat.com/errata/RHSA-2015-2516.html
10	http://rhn.redhat.com/errata/RHSA-2015-2516.html
11	http://rhn.redhat.com/errata/RHSA-2015-2517.html
12	http://rhn.redhat.com/errata/RHSA-2015-2517.html
13	http://rhn.redhat.com/errata/RHSA-2015-2521.html
14	http://rhn.redhat.com/errata/RHSA-2015-2521.html
15	http://rhn.redhat.com/errata/RHSA-2015-2522.html
16	http://rhn.redhat.com/errata/RHSA-2015-2522.html
17	http://rhn.redhat.com/errata/RHSA-2015-2524.html
18	http://rhn.redhat.com/errata/RHSA-2015-2524.html
19	http://rhn.redhat.com/errata/RHSA-2015-2670.html
20	http://rhn.redhat.com/errata/RHSA-2015-2670.html
21	http://rhn.redhat.com/errata/RHSA-2015-2671.html
22	http://rhn.redhat.com/errata/RHSA-2015-2671.html
23	http://rhn.redhat.com/errata/RHSA-2016-0040.html
24	http://rhn.redhat.com/errata/RHSA-2016-0040.html
25	http://rhn.redhat.com/errata/RHSA-2016-1773.html
26	http://rhn.redhat.com/errata/RHSA-2016-1773.html
27	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
28	http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
29	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
30	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
31	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
32	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
33	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
34	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
35	http://www.securityfocus.com/bid/78215	Third Party Advisory VDB Entry
36	http://www.securityfocus.com/bid/78215	Third Party Advisory VDB Entry
37	http://www.securitytracker.com/id/1034097	Third Party Advisory VDB Entry
38	http://www.securitytracker.com/id/1034097	Third Party Advisory VDB Entry
39	http://www.securitytracker.com/id/1037052	Third Party Advisory VDB Entry
40	http://www.securitytracker.com/id/1037052	Third Party Advisory VDB Entry
41	http://www.securitytracker.com/id/1037053	Third Party Advisory VDB Entry
42	http://www.securitytracker.com/id/1037053	Third Party Advisory VDB Entry
43	http://www.securitytracker.com/id/1037640	Third Party Advisory VDB Entry
44	http://www.securitytracker.com/id/1037640	Third Party Advisory VDB Entry
45	https://access.redhat.com/security/vulnerabilities/2059393	Vendor Advisory
46	https://access.redhat.com/security/vulnerabilities/2059393	Vendor Advisory
47	https://access.redhat.com/solutions/2045023	Vendor Advisory
48	https://access.redhat.com/solutions/2045023	Vendor Advisory
49	https://bugzilla.redhat.com/show_bug.cgi?id=1279330	Issue Tracking Third Party Advisory VDB Entry Vendor Advisory
50	https://bugzilla.redhat.com/show_bug.cgi?id=1279330	Issue Tracking Third Party Advisory VDB Entry Vendor Advisory
51	https://rhn.redhat.com/errata/RHSA-2015-2536.html
52	https://rhn.redhat.com/errata/RHSA-2015-2536.html
53	https://security.netapp.com/advisory/ntap-20240216-0010/
54	https://security.netapp.com/advisory/ntap-20240216-0010/
55	https://www.oracle.com/security-alerts/cpujul2020.html
56	https://www.oracle.com/security-alerts/cpujul2020.html

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-502	信頼性のないデータのデシリアライゼーション	https://cwe.mitre.org/data/definitions/502.html

JVN脆弱性情報

複数の Red Hat 製品における信頼性のないデータのデシリアライゼーションに関する脆弱性

タイトル	複数の Red Hat 製品における信頼性のないデータのデシリアライゼーションに関する脆弱性
概要	複数の Red Hat 製品には、信頼性のないデータのデシリアライゼーションに関する脆弱性が存在します。
想定される影響	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2016年4月19日0:00
登録日	2016年4月26日13:39
最終更新日	2017年12月7日12:28

影響を受けるシステム

レッドハット

JBoss Data Grid (JDG) 6.x

JBoss Enterprise Application Platform 4.3.x

JBoss Enterprise Application Platform 5.x

JBoss Enterprise Application Platform 6.x

JBoss xPaaS 3.x

Red Hat JBoss A-MQ 6.x

Red Hat JBoss BPM Suite (BPMS) 6.x

Red Hat JBoss BRMS 5.x

Red Hat JBoss BRMS 6.x

Red Hat JBoss Data Virtualization (JDV) 5.x

Red Hat JBoss Data Virtualization (JDV) 6.x

Red Hat JBoss Fuse 6.x

Red Hat JBoss Fuse Service Works (FSW) 6.x

Red Hat JBoss Operations Network (JBoss ON) 3.x

Red Hat JBoss Portal 6.x

Red Hat JBoss SOA Platform (SOA-P) 5.x

Red Hat JBoss Web Server (JWS) 3.x

Red Hat OpenShift 3.x

Red Hat Subscription Asset Manager 1.3

オラクル

MICROS Retail XBRi Loss Prevention 10.0.1

MICROS Retail XBRi Loss Prevention 10.5.0

MICROS Retail XBRi Loss Prevention 10.6.0

MICROS Retail XBRi Loss Prevention 10.7.0

MICROS Retail XBRi Loss Prevention 10.8.0

MICROS Retail XBRi Loss Prevention 10.8.1

Oracle Application Testing Suite 12.4.0.2

Oracle Application Testing Suite 12.5.0.2

Oracle Banking Platform 2.3.0

Oracle Banking Platform 2.4.0

Oracle Banking Platform 2.4.1

Oracle Communications ASAP 7.0

Oracle Communications ASAP 7.2

Oracle Communications ASAP 7.3

Oracle Documaker 12.5 未満

Oracle Enterprise Manager Ops Center 12.1.4

Oracle Enterprise Manager Ops Center 12.2.2

Oracle Enterprise Manager Ops Center 12.3.2

Oracle Health Sciences Clinical Development Center 3.1.1.x

Oracle Health Sciences Clinical Development Center 3.1.2.x

Oracle Healthcare Analytics Data Integration 3.1.0.0.0

Oracle In-Memory Policy Analytics 12.0.1

Oracle Insurance Calculation Engine 10.1.2

Oracle Insurance Calculation Engine 10.2.2

Oracle Insurance Calculation Engine 9.7.1

Oracle Insurance Policy Administration J2EE 10.0.1

Oracle Insurance Policy Administration J2EE 10.1.2

Oracle Insurance Policy Administration J2EE 10.2.0

Oracle Insurance Policy Administration J2EE 10.2.2

Oracle Insurance Policy Administration J2EE 9.6.1

Oracle Insurance Policy Administration J2EE 9.7.1

Oracle Insurance Rules Palette 10.0.1

Oracle Insurance Rules Palette 10.1.2

Oracle Insurance Rules Palette 10.2.0

Oracle Insurance Rules Palette 10.2.2

Oracle Insurance Rules Palette 9.6.1

Oracle Insurance Rules Palette 9.7.1

Oracle Policy Automation 10.3.0

Oracle Policy Automation 10.3.1

Oracle Policy Automation 10.4.0

Oracle Policy Automation 10.4.1

Oracle Policy Automation 10.4.2

Oracle Policy Automation 10.4.3

Oracle Policy Automation 10.4.4

Oracle Policy Automation 10.4.5

Oracle Policy Automation 10.4.6

Oracle Policy Automation 12.1.0

Oracle Policy Automation 12.1.1

Oracle Policy Automation Connector for Siebel 10.3.0

Oracle Policy Automation Connector for Siebel 10.4.0

Oracle Policy Automation Connector for Siebel 10.4.1

Oracle Policy Automation Connector for Siebel 10.4.2

Oracle Policy Automation Connector for Siebel 10.4.3

Oracle Policy Automation Connector for Siebel 10.4.4

Oracle Policy Automation Connector for Siebel 10.4.5

Oracle Policy Automation Connector for Siebel 10.4.6

Oracle Policy Automation for Mobile Devices 12.1.1

Oracle Retail Central, Back Office, Returns Management 12.0

Oracle Retail Central, Back Office, Returns Management 13.0

Oracle Retail Central, Back Office, Returns Management 13.1

Oracle Retail Central, Back Office, Returns Management 13.2

Oracle Retail Central, Back Office, Returns Management 13.3

Oracle Retail Central, Back Office, Returns Management 13.4

Oracle Retail Central, Back Office, Returns Management 14.0

Oracle Retail Central, Back Office, Returns Management 14.1

Oracle Retail Service Backbone 15.0

Oracle Retail Store Inventory Management 12.0

Oracle Retail Store Inventory Management 13.0

Oracle Retail Store Inventory Management 13.1

Oracle Retail Store Inventory Management 13.2

Oracle Retail Store Inventory Management 14.0

Oracle Retail Store Inventory Management 14.1

Oracle Transportation Management 6.3.0

Oracle Transportation Management 6.3.1

Oracle Transportation Management 6.3.2

Oracle Transportation Management 6.3.3

Oracle Transportation Management 6.3.4

Oracle Transportation Management 6.3.5

Oracle Transportation Management 6.3.6

Oracle Transportation Management 6.3.7

Oracle Transportation Management 6.4.0

Oracle Transportation Management 6.4.1

Oracle Utilities Framework 2.2.0.0.0

Oracle Utilities Framework 4.1.0.1.0

Oracle Utilities Framework 4.1.0.2.0

Oracle Utilities Framework 4.2.0.1.0

Oracle Utilities Framework 4.2.0.2.0

Oracle Utilities Framework 4.2.0.3.0

Oracle Utilities Framework 4.3.0.1.0

Oracle Utilities Framework 4.3.0.2.0

Oracle Utilities Network Management System 1.10.0.6.27

Oracle Utilities Network Management System 1.11.0.4.41

Oracle Utilities Network Management System 1.11.0.5.4

Oracle Utilities Network Management System 1.12.0.1.16

Oracle Utilities Network Management System 1.12.0.2.12

Oracle Utilities Network Management System 1.12.0.3.5

Oracle Utilities Work and Asset Management 1.9.1.2.8

Primavera Contract Management 14.2

Primavera P6 Enterprise Project Portfolio Management 15.1

Primavera P6 Enterprise Project Portfolio Management 15.2

Primavera P6 Enterprise Project Portfolio Management 16.1

Primavera P6 Enterprise Project Portfolio Management 8.2

Primavera P6 Enterprise Project Portfolio Management 8.3

Primavera P6 Enterprise Project Portfolio Management 8.4

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-7501	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7501
National Vulnerability Database (NVD)
2	CVE-2015-7501	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7501

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-502	https://cwe.mitre.org/data/definitions/502.html

ベンダー情報

No	名前	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - April 2016	http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
2	Oracle Critical Patch Update Advisory - July 2016	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
3	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
4	Oracle Critical Patch Update CVSS V2 Risk Matrices - April 2016	http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html
5	Text Form of Oracle Critical Patch Update - April 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapr2016verbose-2881709.html
6	Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2016verbose-2881721.html
7	Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices	http://www.oracle.com/technetwork/security-advisory/cpuoct2016verbose-2881725.html
Red Hat Bugzilla
8	Bug 1279330	https://bugzilla.redhat.com/show_bug.cgi?id=1279330
Red Hat Customer Portal
9	Apache commons-collections: Remote code execution during deserialisation (CVE 2015-7501)	https://access.redhat.com/security/vulnerabilities/2059393
10	Do the unserialization/deserialization exploits against the commons-collections library affect Red Hat JBoss products? (CVE-2015-7501 )	https://access.redhat.com/solutions/2045023
SECURITY BLOG
11	April 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2016_critical_patch_update
12	July 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2016_critical_patch_update
13	October 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2016_critical_patch_update

変更履歴

No	変更内容	変更日
0	[2016年04月26日] 掲載 [2016年07月27日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices) を追加ベンダ情報：オラクル (July 2016 Critical Patch Update Released) を追加 [2016年11月22日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices) を追加ベンダ情報：オラクル (October 2016 Critical Patch Update Released) を追加 [2017年12月06日] タイトル：NVD の更新に伴い内容を更新概要：NVD の更新に伴い内容を更新 CVSS による深刻度：NVD の更新に伴い内容を更新影響を受けるシステム：NVD の更新に伴い内容を更新想定される影響：NVD の更新に伴い内容を更新ベンダ情報：レッドハット (Bug 1279330) を追加ベンダ情報：レッドハット (Apache commons-collections: Remote code execution during deserialisation (CVE 2015-7501)) を追加ベンダ情報：レッドハット (Do the unserialization/deserialization exploits against the commons-collections library affect Red Hat JBoss products? (CVE-2015-7501)) を追加 CWE による脆弱性タイプ一覧：NVD の更新に伴い内容を更新	2018年2月17日10:37

構成1	以上	以下	より上	未満
cpe:2.3:a:redhat:jboss_operations_network:3.0:::::::*
cpe:2.3:a:redhat:jboss_a-mq:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:::::::*
cpe:2.3:a:redhat:openshift:3.0::::enterprise:::
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:::::::*
cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:::::::*
cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:::::::*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:::::::*
cpe:2.3:a:redhat:jboss_portal:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:::::::*
cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:::::::*
cpe:2.3:a:redhat:xpaas:3.0.0:::::::*
cpe:2.3:a:redhat:data_grid:6.0.0:::::::*