CVE-2014-9757: Input Validation

Published Feb 8, 2016

Updated

The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

Affected Software

90 affected components

Atlassian Bamboo=2.4

Atlassian Bamboo=2.4.1

Atlassian Bamboo=2.4.2

Atlassian Bamboo=2.4.3

Atlassian Bamboo=2.5

Atlassian Bamboo=2.5.1

Atlassian Bamboo=2.5.2

Atlassian Bamboo=2.5.3

Atlassian Bamboo=2.5.5

Atlassian Bamboo=2.6

Atlassian Bamboo=2.6.1

Atlassian Bamboo=2.6.2

Atlassian Bamboo=2.6.3

Atlassian Bamboo=2.7

Atlassian Bamboo=2.7.1

Atlassian Bamboo=2.7.2

Atlassian Bamboo=2.7.3

Atlassian Bamboo=2.7.4

Atlassian Bamboo=3.0

Atlassian Bamboo=3.0.1

Atlassian Bamboo=3.0.2

Atlassian Bamboo=3.0.3

Atlassian Bamboo=3.1

Atlassian Bamboo=3.1.1

Atlassian Bamboo=3.1.3

Atlassian Bamboo=3.1.4

Atlassian Bamboo=3.2

Atlassian Bamboo=3.2.2

Atlassian Bamboo=3.3

Atlassian Bamboo=3.3.1

Atlassian Bamboo=3.3.2

Atlassian Bamboo=3.3.3

Atlassian Bamboo=3.3.4

Atlassian Bamboo=3.4

Atlassian Bamboo=3.4.1

Atlassian Bamboo=3.4.2

Atlassian Bamboo=3.4.3

Atlassian Bamboo=3.4.4

Atlassian Bamboo=3.4.5

Atlassian Bamboo=4.0

Atlassian Bamboo=4.0.1

Atlassian Bamboo=4.1

Atlassian Bamboo=4.1.1

Atlassian Bamboo=4.1.2

Atlassian Bamboo=4.2

Atlassian Bamboo=4.2.1

Atlassian Bamboo=4.3

Atlassian Bamboo=4.3.1

Atlassian Bamboo=4.3.2

Atlassian Bamboo=4.3.3

Atlassian Bamboo=4.3.4

Atlassian Bamboo=4.4

Atlassian Bamboo=4.4.1

Atlassian Bamboo=4.4.2

Atlassian Bamboo=4.4.3

Atlassian Bamboo=4.4.4

Atlassian Bamboo=4.4.5

Atlassian Bamboo=4.4.8

Atlassian Bamboo=5.0

Atlassian Bamboo=5.0-beta1

Atlassian Bamboo=5.0-beta2

Atlassian Bamboo=5.0-beta3

Atlassian Bamboo=5.0-rc1

Atlassian Bamboo=5.0.1

Atlassian Bamboo=5.1

Atlassian Bamboo=5.1.1

Atlassian Bamboo=5.2

Atlassian Bamboo=5.2.1

Atlassian Bamboo=5.2.2

Atlassian Bamboo=5.3

Atlassian Bamboo=5.4

Atlassian Bamboo=5.4.1

Atlassian Bamboo=5.4.2

Atlassian Bamboo=5.5

Atlassian Bamboo=5.6

Atlassian Bamboo=5.6.1

Atlassian Bamboo=5.6.2

Atlassian Bamboo=5.7

Atlassian Bamboo=5.7.1

Atlassian Bamboo=5.7.2

Atlassian Bamboo=5.8

Atlassian Bamboo=5.8.1

Atlassian Bamboo=5.8.2

Atlassian Bamboo=5.8.5

Atlassian Bamboo=5.9

Atlassian Bamboo=5.9.1

Atlassian Bamboo=5.9.2

Atlassian Bamboo=5.9.3

Atlassian Bamboo=5.9.4

Atlassian Bamboo=5.9.7

Remediation

Patch Available

https://jira.atlassian.com/browse/BAM-17099

Event History

Feb 8, 2016

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9757?

CVE-2014-9757 has a high severity rating due to the potential for remote code execution via arbitrarily deserialized data.

How do I fix CVE-2014-9757?

To fix CVE-2014-9757, you should upgrade Atlassian Bamboo to version 5.9.9 or 5.10.0 and above to eliminate the vulnerability.

What types of attacks does CVE-2014-9757 enable?

CVE-2014-9757 enables remote attackers to execute arbitrary Java code on the server by sending specially crafted XMPP messages.

Which versions of Atlassian Bamboo are affected by CVE-2014-9757?

Atlassian Bamboo versions prior to 5.9.9 and 5.10.x before 5.10.0 are affected by CVE-2014-9757.

Is CVE-2014-9757 a local or remote vulnerability?

CVE-2014-9757 is a remote vulnerability that can be exploited by attackers from outside the target environment.