CVE-2016-2510 Improper Input Validation in BeanShell
Remote attackers can execute arbitrary code via crafted serialized data in applications using BeanShell with Java serialization or XStream.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2510?
CVE-2016-2510 is a high-severity unsafe deserialization vulnerability in Canonical Ubuntu Linux, published on 7 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Weakness: CWE-19
Which versions are affected by CVE-2016-2510?
2 open source packages ship an affected version, including org.apache-extras.beanshell:bsh. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache-extras.beanshell:bsh Maven | All versions | 2.0b6 |
org.apache-extras.beanshell:bsh Maven | All versions | 2.0b6 |
Linux distribution packages (4)
bsh2 SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 2.0-318.1 |
bsh2 SUSE:Linux Enterprise Software Development Kit 12 | All versions | 2.0.0.b5-3.2 |
bsh2 SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 2.0.0.b5-3.2 |
bsh2 openSUSE:Tumbleweed | All versions | 2.0.0.b6-2.7 |
Products include Beanshell Beanshell, Canonical Ubuntu Linux, Debian Debian Linux.
How do I fix CVE-2016-2510?
Upgrade org.apache-extras.beanshell:bsh to 2.0b6 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-2510 being exploited?
There is no known exploitation of CVE-2016-2510 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-2510, DLA-443-1, DSA-3504-1, GHSA-gxg6-rc6c-v673, SUSE-SU-2016:0699-1, SUSE-SU-2016:0700-1 and 3 more.