Important Information

On August 12th, 2022, many of Keysight’s Network Test, Network Visibility, & Edge to Core (NAS/formerly Ixia) products will migrate to a new license structure.

CRITICAL: If you perform licensing operations after August 12th, 2022, without upgrading the licensing software to the latest version, licenses may not register properly, and some features may be missing. This could impact testing and result in downtime.

For details, click here.

Strike ID:
E20-10e31
CVSS:
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
False Positive:
t
Variants:
3
Year:
2020

Description

This strike exploits an insecure deserialization vulnerability in Oracle Coherence library, which is used in popular products such as Oracle WebLogic Server. Coherence Library is a key component for Oracle to implement highly reliable and scalable cluster computing. The vulnerability is a result of insufficient validation of T3 requests. The server allows deserialization of classes in objects embedded with T3 protocol messages. Successful exploitation leads to remote code execution, in the context of the user running the Oracle WebLogic Service.

CVE

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-2555

References

https://www.zerodayinitiative.com/blog/2020/3/5/cve-2020-2555-rce-through-a-dese...

ZDI

http://www.zerodayinitiative.com/advisories/ZDI-20-128