by kohsuke on 11/7/15, 1:57 AM
by sprkyco on 11/6/15, 11:04 PM
One thing I really liked about the write-up is the thoroughness that everything was explained. Nothing was assumed. The author explains what burp is why it was used. Broke down the basics in a high level and the touched on the simple things. Showed exploits in multiple frameworks. Really a well done article just from a write-up perspective let alone the impact of the issue.
by devonkim on 11/6/15, 11:37 PM
Anyone actually have a CVE I can reference in talks to leadership so I can not look like a neckbeard security geek that's acting self-important?
by el_duderino on 11/6/15, 7:25 PM
Kenn White said it best: "This will get very ugly: unpatched, full remote exec on Java-based web svcs that use a popular serialization library
by btilly on 11/6/15, 9:26 PM
This is very similar to the series of serialization vulnerabilities that hit the Ruby on Rails world in early 2013.
Black hats are going to have fun with this one. :-(
by based2 on 11/6/15, 10:14 PM
by TazeTSchnitzel on 11/6/15, 8:48 PM
The first thing I thought was "written in Java". The more straightforward headline would have been better, I think.
by pythonistic on 11/6/15, 9:19 PM
I had to backport a fix for a similar vulnerability in a Seam installation three years ago. The solution at the time was to limit the directories and sources from which serialized object representations could be read.