ID

VAR-201508-0177


CVE

CVE-2015-3269


TITLE

Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references

Trust: 0.8

sources: CERT/CC: VU#307983

DESCRIPTION

Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Nexus Dashboard Fabric Controller. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the AMF protocol. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the fmserver user. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. However this expanded information is not automatically transferred back to the client, but could be made available by the application. ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2015-0008 Synopsis: VMware product updates address information disclosure issue Issue date: 2015-11-18 Updated on: 2015-11-18 CVE number: CVE-2015-3269 ------------------------------------------------------------------------ 1. Summary VMware product updates address information disclosure issue. 2. Relevant Releases VMware vCenter Server 5.5 prior to version 5.5 update 3 VMware vCenter Server 5.1 prior to version 5.1 update u3b VMware vCenter Server 5.0 prior to version 5.0 update u3e vCloud Director 5.6 prior to version 5.6.4 vCloud Director 5.5 prior to version 5.5.3 VMware Horizon View 6.0 prior to version 6.1 VMware Horizon View 5.0 prior to version 5.3.4 3. Problem Description a. vCenter Server, vCloud Director, Horizon View information disclosure issue. A specially crafted XML request sent to the server could lead to unintended information be disclosed. VMware would like to thank Matthias Kaiser of Code White GmbH for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-3269 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ================= vCenter Server 6.0 any not affected vCenter Server 5.5 any 5.5 update 3 vCenter Server 5.1 any 5.1 update u3b vCenter Server 5.0 any 5.5 update u3e vCloud Director 5.6 any 5.6.4 vCloud Director 5.5 any 5.5.3 Horizon View 6.0 any 6.1 Horizon View 5.3 any 5.3.4 4. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. vCenter Server -------------------------------- Downloads and Documentation: https://www.vmware.com/go/download-vsphere vCloud Director For Service Providers -------------------------------- Downloads and Documentation: https://www.vmware.com/support/pubs/vcd_pubs.html Horizon View 6.1, 5.3.4: -------------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productId=492 https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&productId=396 5. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269 ------------------------------------------------------------------------ 6. Change log 2015-11-18 VMSA-2015-0008 Initial security advisory ------------------------------------------------------------------------ 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce at lists.vmware.com bugtraq at securityfocus.com fulldisclosure at seclists.org E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories Consolidated list of VMware Security Advisories http://kb.vmware.com/kb/2078735 VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html Twitter https://twitter.com/VMwareSRC Copyright 2015 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05026202 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05026202 Version: 2 HPSBGN03550 rev.2 - HP Operations Manager i and BSM using Apache Flex BlazeDS, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2016-03-03 Last Updated: 2016-03-03 Potential Security Impact: Remote Disclosure of Information Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY A security vulnerability in Apache Flex BlazeDS was addressed by HP Operations Manager i (OMi) and Business Service Manager (BSM). Note : OMi v10.10 is NOT affected by this vulnerability. References: CVE-2015-3269 SSRT102232 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Operations Manager i v10.0, v10.01 Business Service Manager v9.x to v9.26 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-3269 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 The Hewlett Packard Enterprise Company thanks Nicholas Miles from Tenable Network Security for reporting this issue to security-alert@hpe.com RESOLUTION HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of Operations Manager i and Business Service Manager: For OMi 10.0 update to OMi 10.0 IP3 or above. The OMi 10.0 IP3 patches can be found here: For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/OMI_00122?lang=en&cc=us&hpappid=202392_OSP_PRO_ HPE For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/OMI_00123?lang=en&cc=us&hpappid=202392_OSP_PRO_HP E For OMi 10.01 update to OMi 10.01 IP2 or above. The OMi 10.01 IP2 patches can be found here: For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/OMI_00120 For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/OMI_00121 OMi 10.10 is NOT affected by this vulnerability. For BSM 9.x to 9.25, update to BSM 9.25 IP2 or above. For Windows: https://softwaresupport.hp.com/group/softwaresupport/search-resu lt/-/facetsearch/document/LID/BAC_00899 For Linux: https://softwaresupport.hp.com/group/softwaresupport/search-result /-/facetsearch/document/LID/BAC_00896 For BSM 9.26 please contact HPE Technical Support. HISTORY Version:1 (rev.1) - 3 March 2016 Initial release Version:2 (rev.2) - 3 March 2016 Added acknowledgment section Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJW2GZoAAoJEGIGBBYqRO9/g7wIAIuGN+IoM69sf1dzu0wROFfj fDKMymKIsUz975nC1VoPm+70FiBRNKwuL73uqA7Gkrhnv1ldxeBjsX058FR3q5ZE mhlhfp86BMKJMtuWI3nTVo25gQM4PVaB6GuS52PrROhwcNRKnGy6K1OlYPEtFXiy OC6YNBwBBbvookB6bPkziPzvdc85zTU8Pc7YDZQoO14vw/k1PDBaFSHs7QnLlrAw 2cZADbYL9QIDWjIO/QVHo8iwYkjpxRmBzK6qXg/Ys1vij6/RYLqMtk5fxxMRlkfS 0oiFiUS8zVf+QASHRAuj4KXeCOCi66UEAgewkDa15GyByubl8WQRg7ovw1fHGUA= =4Dvo -----END PGP SIGNATURE-----

Trust: 4.23

sources: NVD: CVE-2015-3269 // CERT/CC: VU#307983 // CERT/CC: VU#279472 // JVNDB: JVNDB-2015-004431 // ZDI: ZDI-22-508 // BID: 76394 // PACKETSTORM: 133250 // PACKETSTORM: 134439 // PACKETSTORM: 136084

AFFECTED PRODUCTS

vendor:adobemodel:livecycle data servicesscope:eqversion:3.0

Trust: 1.9

vendor:adobemodel:livecycle data servicesscope:eqversion:4.7

Trust: 1.9

vendor:adobemodel:livecycle data servicesscope:eqversion:4.5

Trust: 1.9

vendor:adobemodel:livecycle data servicesscope:eqversion:4.6

Trust: 1.6

vendor:hpmodel:business service managementscope:lteversion:9.26

Trust: 1.0

vendor:adobemodel: - scope: - version: -

Trust: 0.8

vendor:apachemodel: - scope: - version: -

Trust: 0.8

vendor:atlassianmodel: - scope: - version: -

Trust: 0.8

vendor:vmwaremodel: - scope: - version: -

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:3.0.0.354170

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:4.6.2

Trust: 0.8

vendor:hitachimodel:jp1/it desktop management - managerscope: - version: -

Trust: 0.8

vendor:hitachimodel:jp1/automatic operationscope: - version: -

Trust: 0.8

vendor:hitachimodel:job management partner 1/it desktop managementscope:eqversion:2 - manager

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:4.5.1.354169

Trust: 0.8

vendor:hitachimodel:it operations directorscope: - version: -

Trust: 0.8

vendor:hitachimodel:compute systems managerscope:eqversion:software ( domestic version )

Trust: 0.8

vendor:hitachimodel:jp1/it desktop managementscope:eqversion:2 - manager

Trust: 0.8

vendor:hitachimodel:job management partner 1/it desktop management - managerscope: - version: -

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:3.0.x

Trust: 0.8

vendor:hitachimodel:compute systems managerscope:eqversion:software ( overseas edition )

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:4.7.0.354169

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:4.7

Trust: 0.8

vendor:hitachimodel:automation directorscope: - version: -

Trust: 0.8

vendor:hitachimodel:job management partnerscope:eqversion:1/automatic operation

Trust: 0.8

vendor:hitachimodel:device managerscope:eqversion:software

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:eqversion:4.6.2.354169

Trust: 0.8

vendor:adobemodel:livecycle data servicesscope:ltversion:4.5

Trust: 0.8

vendor:ciscomodel:nexus dashboard fabric controllerscope: - version: -

Trust: 0.7

vendor:vmwaremodel:vcloud directorscope:eqversion:5.5

Trust: 0.3

vendor:vmwaremodel:vcloud directorscope:eqversion:5.6

Trust: 0.3

vendor:vmwaremodel:vcenter server update1scope:eqversion:5.5

Trust: 0.3

vendor:vmwaremodel:vcenter server updatescope:eqversion:5.52

Trust: 0.3

vendor:vmwaremodel:vcenter serverscope:eqversion:5.5

Trust: 0.3

vendor:vmwaremodel:vcenter server updatescope:eqversion:5.13

Trust: 0.3

vendor:vmwaremodel:vcenter server updatescope:eqversion:5.11

Trust: 0.3

vendor:vmwaremodel:vcenter serverscope:eqversion:5.1

Trust: 0.3

vendor:vmwaremodel:vcenter server update2scope:eqversion:5.0

Trust: 0.3

vendor:vmwaremodel:vcenter server update u3bscope:eqversion:5.0

Trust: 0.3

vendor:vmwaremodel:vcenter server update 3cscope:eqversion:5.0

Trust: 0.3

vendor:vmwaremodel:vcenter server updatescope:eqversion:5.01

Trust: 0.3

vendor:vmwaremodel:vcenter serverscope:eqversion:5.0

Trust: 0.3

vendor:vmwaremodel:horizon viewscope:eqversion:5.3.1

Trust: 0.3

vendor:vmwaremodel:horizon viewscope:eqversion:6.0

Trust: 0.3

vendor:vmwaremodel:horizon viewscope:eqversion:5.3

Trust: 0.3

vendor:hpmodel:operations manager iscope:eqversion:10.01

Trust: 0.3

vendor:hpmodel:operations manager iscope:eqversion:10.00

Trust: 0.3

vendor:hpmodel:business service managerscope:eqversion:9.26

Trust: 0.3

vendor:hpmodel:business service managerscope:eqversion:9.20

Trust: 0.3

vendor:hpmodel:business service managerscope:eqversion:9.10

Trust: 0.3

vendor:hitachimodel:jp1/automatic operationscope:eqversion:10-02

Trust: 0.3

vendor:hitachimodel:jp1/automatic operationscope:eqversion:10-01

Trust: 0.3

vendor:hitachimodel:jp1/automatic operationscope:eqversion:10-00-02

Trust: 0.3

vendor:hitachimodel:jp1/automatic operationscope:eqversion:10-00

Trust: 0.3

vendor:hitachimodel:job management partner 1/automatic operationscope:eqversion:10-50

Trust: 0.3

vendor:hitachimodel:job management partner 1/automatic operationscope:eqversion:10-10-01

Trust: 0.3

vendor:hitachimodel:job management partner 1/automatic operationscope:eqversion:10-00-03

Trust: 0.3

vendor:hitachimodel:job management partner 1/automatic operationscope:eqversion:10-00-02

Trust: 0.3

vendor:apachemodel:flex blazedsscope:eqversion:4.7

Trust: 0.3

vendor:apachemodel:flex blazedsscope:eqversion:4.6.0.23207

Trust: 0.3

vendor:adobemodel:livecycle data servicesscope:eqversion:4.6.2

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:115

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:114

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:113

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:112

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:111

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:10.08

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:10.04

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:10.03

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:10.02

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:10.01

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:109

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:106

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:105

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1016

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1015

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1014

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1013

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1012

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1011

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:1010

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:eqversion:101

Trust: 0.3

vendor:adobemodel:coldfusionscope:eqversion:10

Trust: 0.3

vendor:vmwaremodel:vcloud directorscope:neversion:5.6.4

Trust: 0.3

vendor:vmwaremodel:vcloud directorscope:neversion:5.5.3

Trust: 0.3

vendor:vmwaremodel:vcenter server updatescope:neversion:5.53

Trust: 0.3

vendor:vmwaremodel:vcenter server update u3bscope:neversion:5.1

Trust: 0.3

vendor:vmwaremodel:vcenter server update u3escope:neversion:5.0

Trust: 0.3

vendor:vmwaremodel:horizon viewscope:neversion:5.3.4

Trust: 0.3

vendor:vmwaremodel:horizon viewscope:neversion:6.1

Trust: 0.3

vendor:hitachimodel:jp1/automatic operationscope:neversion:11-00-01

Trust: 0.3

vendor:apachemodel:flex blazedsscope:neversion:4.7.1

Trust: 0.3

vendor:adobemodel:livecycle data servicesscope:neversion:6.2.354169

Trust: 0.3

vendor:adobemodel:livecycle data servicesscope:neversion:4.7.0.3541694

Trust: 0.3

vendor:adobemodel:livecycle data servicesscope:neversion:4.5.1.354169

Trust: 0.3

vendor:adobemodel:livecycle data servicesscope:neversion:3.0.0.354170

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:neversion:116

Trust: 0.3

vendor:adobemodel:coldfusion updatescope:neversion:1017

Trust: 0.3

sources: CERT/CC: VU#307983 // ZDI: ZDI-22-508 // BID: 76394 // JVNDB: JVNDB-2015-004431 // CNNVD: CNNVD-201508-438 // NVD: CVE-2015-3269

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-3269
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-2340
value: MEDIUM

Trust: 0.8

NVD: CVE-2015-3269
value: MEDIUM

Trust: 0.8

ZDI: CVE-2015-3269
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201508-438
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2015-3269
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2016-2340
severity: MEDIUM
baseScore: 4.3
vectorString: NONE
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

ZDI: CVE-2015-3269
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 0.7

sources: CERT/CC: VU#279472 // ZDI: ZDI-22-508 // JVNDB: JVNDB-2015-004431 // CNNVD: CNNVD-201508-438 // NVD: CVE-2015-3269

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2015-004431 // NVD: CVE-2015-3269

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201508-438

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201508-438

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-004431

EXPLOIT AVAILABILITY

sources: CERT/CC: VU#279472

PATCH

title:APSB15-20url:https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html

Trust: 0.8

title:APSB15-20url:https://helpx.adobe.com/jp/security/products/livecycleds/apsb15-20.html

Trust: 0.8

title:HS16-009url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-009/index.html

Trust: 0.8

title:HS16-005url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS16-005/index.html

Trust: 0.8

title:HS15-028url:http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS15-028/index.html

Trust: 0.8

title:HS16-009url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-009/index.html

Trust: 0.8

title:HS16-005url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS16-005/index.html

Trust: 0.8

title:HS15-028url:http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS15-028/index.html

Trust: 0.8

title:LCDS_4.6.2url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57450

Trust: 0.6

title:LCDS_4.5.1url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57449

Trust: 0.6

title:LCDS_3.1.0url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57448

Trust: 0.6

title:LCDS_3.0.0url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57447

Trust: 0.6

title:LCDS_4.7.0url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57451

Trust: 0.6

sources: JVNDB: JVNDB-2015-004431 // CNNVD: CNNVD-201508-438

EXTERNAL IDS

db:NVDid:CVE-2015-3269

Trust: 4.5

db:ZDIid:ZDI-22-508

Trust: 2.3

db:BIDid:76394

Trust: 1.9

db:CERT/CCid:VU#279472

Trust: 1.6

db:SECTRACKid:1033337

Trust: 1.6

db:CERT/CCid:VU#307983

Trust: 1.1

db:JVNDBid:JVNDB-2015-004431

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15192

Trust: 0.7

db:NSFOCUSid:46622

Trust: 0.6

db:CNNVDid:CNNVD-201508-438

Trust: 0.6

db:HITACHIid:HS16-005

Trust: 0.3

db:PACKETSTORMid:133250

Trust: 0.1

db:PACKETSTORMid:134439

Trust: 0.1

db:PACKETSTORMid:136084

Trust: 0.1

sources: CERT/CC: VU#307983 // CERT/CC: VU#279472 // ZDI: ZDI-22-508 // BID: 76394 // JVNDB: JVNDB-2015-004431 // PACKETSTORM: 133250 // PACKETSTORM: 134439 // PACKETSTORM: 136084 // CNNVD: CNNVD-201508-438 // NVD: CVE-2015-3269

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-508/

Trust: 2.2

url:https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html

Trust: 1.9

url:http://www.securitytracker.com/id/1033337

Trust: 1.6

url:http://www.securityfocus.com/archive/1/536266/100/0/threaded

Trust: 1.6

url:http://www.vmware.com/security/advisories/vmsa-2015-0008.html

Trust: 1.6

url:http://marc.info/?l=bugtraq&m=145706712500978&w=2

Trust: 1.6

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05026202

Trust: 1.6

url:http://www.securityfocus.com/bid/76394

Trust: 1.6

url:https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html

Trust: 1.6

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3269

Trust: 0.9

url:http://codewhitesec.blogspot.com/2017/04/amf.html

Trust: 0.8

url:http://openjdk.java.net/jeps/290

Trust: 0.8

url:http://www.kb.cert.org/vuls/id/279472

Trust: 0.8

url:http://www.adobe.com/go/amfspec

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/502.html

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/913.html

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/611.html

Trust: 0.8

url:https://flex.apache.org/download-blazeds.html

Trust: 0.8

url:https://www.vmware.com/security/advisories/vmsa-2017-0007.html

Trust: 0.8

url:http://codewhitesec.blogspot.com/2015/08/cve-2015-3269-apache-flex-blazeds-xxe.html

Trust: 0.8

url:https://www.owasp.org/index.php/xml_external_entity_%28xxe%29_processing

Trust: 0.8

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3269

Trust: 0.8

url:http://www.securityfocus.com/archive/1/archive/1/536266/100/0/threaded

Trust: 0.8

url:http://www.nsfocus.net/vulndb/46622

Trust: 0.6

url:http://www.adobe.com

Trust: 0.3

url:http://www.adobe.com/devnet/livecycle/dataservices.html

Trust: 0.3

url:http://seclists.org/oss-sec/2015/q3/394

Trust: 0.3

url:https://helpx.adobe.com/security/products/coldfusion/apsb15-21.html

Trust: 0.3

url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05026202

Trust: 0.3

url:http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-005/index.html

Trust: 0.3

url:http://www.vmware.com/security/advisories/vmsa-2015-0008

Trust: 0.3

url:http://www.kb.cert.org/vuls/id/307983

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-3269

Trust: 0.3

url:https://www.owasp.org/index.php/xml_external_entity_(xxe)_processing

Trust: 0.1

url:https://twitter.com/vmwaresrc

Trust: 0.1

url:https://my.vmware.com/web/vmware/details?downloadgroup=view-534-premier&productid=396

Trust: 0.1

url:https://www.vmware.com/support/policies/lifecycle.html

Trust: 0.1

url:http://kb.vmware.com/kb/1055

Trust: 0.1

url:http://www.vmware.com/security/advisories

Trust: 0.1

url:https://www.vmware.com/go/download-vsphere

Trust: 0.1

url:http://kb.vmware.com/kb/2078735

Trust: 0.1

url:http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

Trust: 0.1

url:https://www.vmware.com/support/policies/security_response.html

Trust: 0.1

url:https://www.vmware.com/support/pubs/vcd_pubs.html

Trust: 0.1

url:https://my.vmware.com/web/vmware/details?downloadgroup=view-610-ga&productid=492

Trust: 0.1

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n

Trust: 0.1

url:https://softwaresupport.hp.com/group/softwaresupport/search-resu

Trust: 0.1

url:http://www.hpe.com/support/security_bulletin_archive

Trust: 0.1

url:http://www.hpe.com/support/subscriber_choice

Trust: 0.1

url:https://softwaresupport.hp.com/group/softwaresupport/search-result

Trust: 0.1

sources: CERT/CC: VU#307983 // CERT/CC: VU#279472 // BID: 76394 // JVNDB: JVNDB-2015-004431 // PACKETSTORM: 133250 // PACKETSTORM: 134439 // PACKETSTORM: 136084 // CNNVD: CNNVD-201508-438 // NVD: CVE-2015-3269

CREDITS

kpc

Trust: 1.3

sources: ZDI: ZDI-22-508 // CNNVD: CNNVD-201508-438

SOURCES

db:CERT/CCid:VU#307983
db:CERT/CCid:VU#279472
db:ZDIid:ZDI-22-508
db:BIDid:76394
db:JVNDBid:JVNDB-2015-004431
db:PACKETSTORMid:133250
db:PACKETSTORMid:134439
db:PACKETSTORMid:136084
db:CNNVDid:CNNVD-201508-438
db:NVDid:CVE-2015-3269

LAST UPDATE DATE

2024-09-09T22:58:05.124000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#307983date:2017-04-14T00:00:00
db:CERT/CCid:VU#279472date:2016-03-24T00:00:00
db:ZDIid:ZDI-22-508date:2022-03-11T00:00:00
db:BIDid:76394date:2017-04-11T01:03:00
db:JVNDBid:JVNDB-2015-004431date:2016-03-24T00:00:00
db:CNNVDid:CNNVD-201508-438date:2022-03-14T00:00:00
db:NVDid:CVE-2015-3269date:2022-03-11T17:15:08.207

SOURCES RELEASE DATE

db:CERT/CCid:VU#307983date:2017-04-04T00:00:00
db:CERT/CCid:VU#279472date:2016-03-24T00:00:00
db:ZDIid:ZDI-22-508date:2022-03-11T00:00:00
db:BIDid:76394date:2015-08-18T00:00:00
db:JVNDBid:JVNDB-2015-004431date:2015-08-27T00:00:00
db:PACKETSTORMid:133250date:2015-08-22T13:33:33
db:PACKETSTORMid:134439date:2015-11-19T14:15:30
db:PACKETSTORMid:136084date:2016-03-04T16:03:09
db:CNNVDid:CNNVD-201508-438date:2015-08-20T00:00:00
db:NVDid:CVE-2015-3269date:2015-08-25T01:59:00.087