CVE-2016-3129 Command injection in BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25
Remote attackers can execute commands on the Karaf shell to gain local administrator rights on the BlackBerry GEMS server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-3129?
CVE-2016-3129 is a medium-severity command injection vulnerability in BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25, published on 16 Dec 2016. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell.
Which versions are affected by CVE-2016-3129?
It affects 1 product.
Products include Blackberry Good Enterprise Mobility Server.
How do I fix CVE-2016-3129?
No fix has been published for CVE-2016-3129 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-3129 being exploited?
There is no known exploitation of CVE-2016-3129 in the wild and no public exploit code.
Sources
Also known as GHSA-53j4-j69m-55qw.