CVE-2016-6500: Input Validation
Published Feb 3, 2017
·Updated
Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true, which allows remote attackers to execute arbitrary code via a crafted serialized Java object, aka LDAP entry poisoning.
Affected Software
1 affected component
ForgeRock RACF Connector<=1.1.0.0
Event History
Feb 3, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6500?
CVE-2016-6500 has a high severity rating due to its potential for remote code execution.
2
How do I fix CVE-2016-6500?
To fix CVE-2016-6500, upgrade the ForgeRock RACF Connector to version 1.1.1.0 or later.
3
What affects my systems regarding CVE-2016-6500?
CVE-2016-6500 affects versions of ForgeRock RACF Connector prior to 1.1.1.0.
4
What type of attacks are possible with CVE-2016-6500?
CVE-2016-6500 may allow remote attackers to execute arbitrary code through LDAP entry poisoning.
5
Is CVE-2016-6500 a widely exploited vulnerability?
While CVE-2016-6500 is known, its actual exploitation in the wild may vary.