Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Ubuntu 4496-1: Critical Advisory for Apache XML-RPC Code Execution

ubuntu
Calendar Grey September 15, 2020
Dist Ubuntu Esm H88
Uncover the significant Apache XML-RPC flaw in Ubuntu. Comprehensive upgrade steps provided for impacted installations.
Apache XML-RPC could be made to execute arbitrary code if it received specially crafted data by a malicious XML-RPC server.

Summary

Apache XML-RPC could be made to execute arbitrary code if it received

specially crafted data by a malicious XML-RPC server.

Software Description:

- libxmlrpc3-java: XML-RPC implementation in Java

Details:

It was discovered that Apache XML-RPC (aka ws-xmlrpc) does not properly

deserialize untrusted data. An attacker could possibly use this issue to

execute arbitrary code. (CVE-2019-17570)

Topics%20covered

Topics Covered

security advisory code execution Ubuntu arbitrary code severity: critical malicious data Apache XML-RPC

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
  libxmlrpc3-client-java          3.1.3-9+deb10u1build0.18.04.1
  libxmlrpc3-common-java          3.1.3-9+deb10u1build0.18.04.1
  libxmlrpc3-server-java          3.1.3-9+deb10u1build0.18.04.1

Ubuntu 16.04 LTS:
  libxmlrpc3-client-java          3.1.3-7+deb8u1build0.16.04.1
  libxmlrpc3-common-java          3.1.3-7+deb8u1build0.16.04.1
  libxmlrpc3-server-java          3.1.3-7+deb8u1build0.16.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4496-1

CVE-2019-17570

Severity
critical
Lowest
Low
Medium
High
Critical

September 15, 2020

Topics%20covered

Topics Covered

security advisory code execution Ubuntu arbitrary code severity: critical malicious data Apache XML-RPC

Package Information

https://launchpad.net/ubuntu/+source/libxmlrpc3-java/3.1.3-9+deb10u1build0.18.04.1
https://launchpad.net/ubuntu/+source/libxmlrpc3-java/3.1.3-7+deb8u1build0.16.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here