CVE-2017-5878

EUVD-2017-14953
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
red5media_server
1.0.2
red5media_server
1.0.2:milestone1
red5media_server
1.0.3
red5media_server
1.0.4
red5media_server
1.0.5
red5media_server
1.0.6
red5media_server
1.0.7
red5media_server
1.0.7:milestone1
red5media_server
1.0.7:milestone2
red5media_server
1.0.7:milestone3
red5media_server
1.0.7:milestone4
red5media_server
1.0.7:milestone5
red5media_server
1.0.7:milestone6
red5media_server
1.0.7:milestone7
red5media_server
1.0.8:milestone1
red5media_server
1.0.8:milestone10
red5media_server
1.0.8:milestone11
red5media_server
1.0.8:milestone12
red5media_server
1.0.8:milestone13
red5media_server
1.0.8:milestone2
red5media_server
1.0.8:milestone3
red5media_server
1.0.8:milestone4
red5media_server
1.0.8:milestone5
red5media_server
1.0.8:milestone6
red5media_server
1.0.8:milestone7
red5media_server
1.0.8:milestone8
red5media_server
1.0.8:milestone9
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
red5
artful
ignored
bionic
dne
cosmic
dne
disco
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
mantic
dne
noble
dne
trusty
dne
xenial
needed
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2017/05/22/2
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
http://www.openwall.com/lists/oss-security/2017/05/22/2
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true