FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

bsh -- remote code execution vulnerability

Affected packages
bsh < 2.0.b6

Details

VuXML ID 9e5bbffc-d8ac-11e5-b2bd-002590263bf5
Discovery 2016-02-18
Entry 2016-02-21

Stian Soiland-Reyes reports:

This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Muñoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix!

An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.

A vulnerable application could be exploited for remote code execution, including executing arbitrary shell commands.

This update fixes the vulnerability in BeanShell, but it is worth noting that applications doing such deserialization might still be insecure through other libraries. It is recommended that application developers take further measures such as using a restricted class loader when deserializing. See notes on Java serialization security XStream security and How to secure deserialization from untrusted input without using encryption or sealing.

References

CVE Name CVE-2016-2510
FreeBSD PR ports/207334
URL https://github.com/beanshell/beanshell/releases/tag/2.0b6