CVE-2016-9299
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 97%
from disclosure to weapon490 days
Published on NVDJan 12
1st PoC+490d
metasploitNov 16
VulnCheckNov 16
exploitation probability
97%top 1% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Under investigation
2 products (3 components)
Red Hat OpenShift Enterprise 3 · Red Hat OpenShift Enterprise 2
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
Affected products
n/a · n/apublic PoCs found — 3✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44642githubgithub.com/r00t4dm/Jenkins-CVE-2016-9299★ 0cve_referencewww.exploit-db.com/exploits/44642/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJhttps://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/LZ7EOS0fBgAJhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6/https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16https://www.cloudbees.com/jenkins-security-advisory-2016-11-16https://www.exploit-db.com/exploits/44642/http://www.openwall.com/lists/oss-security/2016/11/12/4http://www.openwall.com/lists/oss-security/2016/11/14/9http://www.securityfocus.com/bid/94281http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition