remote execution of untrusted code in class MethodClosure
CVE: CVE-2015-3253
Component: groovy
CWE: CWE-284
Severity: Important
CVSS v3: 9.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2015-07-16T00:00:00+00:00

A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Data Virtualization installation (including its
databases, applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss Data Virtualization
server by stopping the JBoss Application Server process before installing
this update, and then after installing the update, restart the Red Hat
JBoss Data Virtualization server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the updates). Before applying the updates, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Refer to the JBoss Operations Network 3.3.5 Release Notes for
installation information.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss SOA Platform installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss SOA Platform server
by stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss SOA
Platform server by starting the JBoss Application Server process.
Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):

    public class MethodClosure extends Closure {
        +    private Object readResolve() {
        +        throw new UnsupportedOperationException();
        +    
        }

Alternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.