# MA-534.112015: MyCERT Advisory - Apache Commons Collections Java Library Vulnerability

**Date:** 16 Nov 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-534.112015  
**Advisory ID:** MA-534.112015

---

#### **1.0 Introduction**
US-CERT is aware of a deserialization vulnerability in the Apache Commons Collections (ACC) Java library. Java applications that either directly use ACC, or contain ACC in their classpath, may be vulnerable to arbitrary code execution.
Users and administrators are encouraged to review Vulnerability Note VU#576313 for more information and apply the necessary mitigations.
**2.0 Impact**
These updates address exploitation of some of these vulnerabilities may insecure deserialization of data, which may result in arbitrary code execution. Java applications that either directly use ACC, or contain ACC in their classpath, may be vulnerable to arbitrary code execution.
A Java application or library with the Apache Commons Collections library in its classpath may be coerced into executing arbitrary Java functions or bytecode, regardless if the application directly uses ACC to deserialize data from an untrusted source or not.
**3.0 Affected Products**
The affected product is both versions 3.2.1 and 4.0 of the Apache Commons Collections (ACC) library have been identified as being vulnerable to this deserialization issue. This issue affects several large projects that utilize ACC including WebSphere, JBoss, Jenkins, WebLogic, and OpenNMS.
**4.0 Recommendation**
MyCERT highly recommended users of these applications to consider the following recommendations:
> **4.1 Use firewall rules or filesystem restrictions**:
>
> Restricting access to the network and/or filesystem. If an affected application, such as Jenkins, utilizes an open port accepting serialized objects, restricting access to the application may help mitigate the issue
>
> **4.2 Developers may need to re-architect their applications:**
>
> Apache Commons Collections is preparing a new release to help mitigate the issue; however, the proposed patch would only disable the serialization functionality by default, requiring developers to re-enable serialization and make further architectural changes to secure the application.
>
> **4.3Be suspicious of deserialized data from an untrusted source**:
>
> Developers should in general be very suspicious of deserialized data from an untrusted source.
>
> For best practices, please refer to :
> CERT Oracle Coding Standard for Java guidelines for Serialization :
> <https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=27492407>
>
> Especially rules of :
> SER12-J : <https://www.securecoding.cert.org/confluence/display/java/SER12-J.+Prevent+deserialization+of+untrusted+classes>
>
> SER13-J : <https://www.securecoding.cert.org/confluence/display/java/SER13-J.+Treat+data+to+be+deserialized+as+potentially+malicious+by+default>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#0e6d776c6b7c3737374e6d776c6b7c7d6b6d7b7c677a77206377) or [[email protected]](/cdn-cgi/l/email-protection#e5889c86809791a5889c86809791cb8a9782cb889c) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Apache Commons Collections Java Library Vulnerability:
<https://www.us-cert.gov/ncas/current-activity/2015/11/13/Apache-Commons-Collections-Java-Library-Vulnerability>
- Vulnerability Note VU#576313:
<http://www.kb.cert.org/vuls/id/576313>