Vulnerability Name:

CCN-68025

Published:2011-06-14
Updated:2011-06-14
Summary:LiveCycle Data Services and BlazeDS could allow a remote attacker to execute arbitrary code on the system, caused by an error during AMF/AMFX deserialization. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: SA43013
Adobe ColdFusion Multiple Vulnerabilities

Source: CCN
Type: SA44922
Adobe LiveCycle / BlazeDS Two Vulnerabilities

Source: CCN
Type: Adobe Product Security Bulletin APSB11-14
Security update: Hotfix available for ColdFusion

Source: CCN
Type: Adobe Product Security Bulletin APSB11-15
Security update available for LiveCycle Data Services, LiveCycle ES, and BlazeDS

Source: CCN
Type: BID-48267
Adobe LiveCycle Data Services and BlazeDS Remote Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
livecycle-amfamfx-code-execution(68025)

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:adobe:coldfusion:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:coldfusion:8.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:coldfusion:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:coldfusion:9.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:livecycle:8.2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:livecycle:9.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:livecycle_data_services:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:livecycle_data_services:2.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:livecycle_data_services:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:blazeds:4.0.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    adobe coldfusion 8.0
    adobe coldfusion 8.0.1
    adobe coldfusion 9.0
    adobe coldfusion 9.0.1
    adobe livecycle 8.2.1.3
    adobe livecycle 9.0.0.2
    adobe livecycle data services 3.1
    adobe livecycle data services 2.6.1
    adobe livecycle data services 2.5.1
    adobe blazeds 4.0.1