Vulnerability-Lookup

CNVD-2016-13021

Vulnerability from cnvd - Published: 2016-12-26

Title

BlackBerry Good Enterprise Mobility Server任意命令执行漏洞

Description

BlackBerry Good Enterprise Mobility Server（GEMS）是加拿大黑莓（BlackBerry）公司的一款企业级移动服务器。 BlackBerry GEMS 2.1.5.3版本至2.2.22.25版本中的Apache Karaf中存在安全漏洞。远程攻击者可通过执行命令利用该漏洞获取本地管理员权限。

Severity

高

Patch Name

BlackBerry Good Enterprise Mobility Server任意命令执行漏洞的补丁

Patch Description

Formal description

前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://support.blackberry.com/kb/articleDetail?articleNumber=000038814&language=None

Reference

http://support.blackberry.com/kb/articleDetail?articleNumber=000038814&amp;language=None

Impacted products

Name
Blackberry Good Enterprise Mobility Server >=2.1.5.3，<=2.2.22.25

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94959"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-3129"
    }
  },
  "description": "BlackBerry Good Enterprise Mobility Server\uff08GEMS\uff09\u662f\u52a0\u62ff\u5927\u9ed1\u8393\uff08BlackBerry\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u79fb\u52a8\u670d\u52a1\u5668\u3002\r\n\r\nBlackBerry GEMS 2.1.5.3\u7248\u672c\u81f32.2.22.25\u7248\u672c\u4e2d\u7684Apache Karaf\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6267\u884c\u547d\u4ee4\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u672c\u5730\u7ba1\u7406\u5458\u6743\u9650\u3002",
  "discovererName": "Blackberry",
  "formalWay": "\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://support.blackberry.com/kb/articleDetail?articleNumber=000038814\u0026language=None",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-13021",
  "openTime": "2016-12-26",
  "patchDescription": "BlackBerry Good Enterprise Mobility Server\uff08GEMS\uff09\u662f\u52a0\u62ff\u5927\u9ed1\u8393\uff08BlackBerry\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u79fb\u52a8\u670d\u52a1\u5668\u3002\r\n\r\nBlackBerry GEMS 2.1.5.3\u7248\u672c\u81f32.2.22.25\u7248\u672c\u4e2d\u7684Apache Karaf\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6267\u884c\u547d\u4ee4\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u672c\u5730\u7ba1\u7406\u5458\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "BlackBerry Good Enterprise Mobility Server\u4efb\u610f\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Blackberry Good Enterprise Mobility Server \u003e=2.1.5.3\uff0c\u003c=2.2.22.25"
  },
  "referenceLink": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038814\u0026amp;amp;language=None",
  "serverity": "\u9ad8",
  "submitTime": "2016-12-20",
  "title": "BlackBerry Good Enterprise Mobility Server\u4efb\u610f\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e"
}

CVE-2016-3129 (GCVE-0-2016-3129)

Vulnerability from cvelistv5 – Published: 2016-12-16 09:02 – Updated: 2024-08-05 23:47

Summary

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell.

Severity ?

No CVSS data available.

CWE

remote shell execution

Assigner

blackberry

References

URL

Tags

	http://support.blackberry.com/kb/articleDetail?ar…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94959	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25	Affected: BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:47:57.227Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038814\u0026language=None"
          },
          {
            "name": "94959",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94959"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25"
            }
          ]
        }
      ],
      "datePublic": "2016-12-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "remote shell execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-20T10:57:01.000Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038814\u0026language=None"
        },
        {
          "name": "94959",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94959"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@blackberry.com",
          "ID": "CVE-2016-3129",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "remote shell execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038814\u0026language=None",
              "refsource": "CONFIRM",
              "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038814\u0026language=None"
            },
            {
              "name": "94959",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94959"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2016-3129",
    "datePublished": "2016-12-16T09:02:00.000Z",
    "dateReserved": "2016-03-11T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:47:57.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-13021

CVE-2016-3129 (GCVE-0-2016-3129)

Tags

Sightings

Nomenclature