Skip to main content
Information Security

Return to Answer

deleted 21 characters in body; added 9 characters in body
Source Link
ARau
ARau
  • 619
  • 4
  • 9

This vulnerability is actually very widespread especially inside Enterprises that use Java heavily. There is an excellent article written by Sijmen Ruwhof that covers this topic and how it effects a lot of leading Java application servers and tools like Jenkins.

There is also a great article written by Will Sargent which goes into the problems with Java serialization, the various ways it can be exploited and suggests some mitigations. One of the mitigations is installing the NotSoSerial Java agent on all JVMs in your network. This is would be an easier fix as you don't have to waitin the short term while waiting for all the applications to be rebuilt and patched as itand rebuilt. It involves putting this jar in yourjust modifying the JVM argument as a java agentstartup arguments.

This vulnerability is actually very widespread especially inside Enterprises that use Java heavily. There is an excellent article written by Sijmen Ruwhof that covers this topic and how it effects a lot of leading Java application servers and tools like Jenkins.

There is also a great article written by Will Sargent which goes into the problems with Java serialization, the various ways it can be exploited and suggests some mitigations. One of the mitigations is installing the NotSoSerial Java agent on all JVMs in your network. This is would be an easier fix as you don't have to wait for all the applications to be rebuilt and patched as it involves putting this jar in your JVM argument as a java agent.

This vulnerability is actually very widespread especially inside Enterprises that use Java heavily. There is an excellent article written by Sijmen Ruwhof that covers this topic and how it effects a lot of leading Java application servers and tools like Jenkins.

There is also a great article written by Will Sargent which goes into the problems with Java serialization, the various ways it can be exploited and suggests some mitigations. One of the mitigations is installing the NotSoSerial Java agent on all JVMs in your network. This would be an easier fix in the short term while waiting for all the applications to be patched and rebuilt. It involves just modifying the JVM startup arguments.

Source Link
ARau
ARau
  • 619
  • 4
  • 9

This vulnerability is actually very widespread especially inside Enterprises that use Java heavily. There is an excellent article written by Sijmen Ruwhof that covers this topic and how it effects a lot of leading Java application servers and tools like Jenkins.

There is also a great article written by Will Sargent which goes into the problems with Java serialization, the various ways it can be exploited and suggests some mitigations. One of the mitigations is installing the NotSoSerial Java agent on all JVMs in your network. This is would be an easier fix as you don't have to wait for all the applications to be rebuilt and patched as it involves putting this jar in your JVM argument as a java agent.