Lightstreamer (Vendor): news timeline & CVEs

[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)

Researchers disclosed an unauthenticated JMX flaw in Lightstreamer Server 7.4.8 that can load native code in the JVM.

The 0day Rubbish Research Team disclosed an unauthenticated access flaw in Lightstreamer Server 7.4.8 build 3506 with JMS Extender 2.1.0. An anonymous caller can use the JMX inspection console to invoke MBean operations, including loading a native agent into the broker JVM. The report cites CWE-306, CWE-345, CWE-20, CWE-250 and CWE-1188 and scores the issue 8.1. No CVE or in-the-wild exploitation is mentioned.

Full Disclosure04:12 UTC · 4h agoVulnerability 2 sources

[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)

Lightstreamer Server 7.4.8 ships placeholder JMX credentials that enable remote class loading and root code execution.

Researchers disclosed a flaw in Lightstreamer Server 7.4.8 build 3506 Enterprise with JMS Extender 2.1.0, scored 9.8. The distribution ships placeholder JMX/RMI credentials and exposes a cleartext RMI management connector on TCP 8888 bound to every interface. Access through that connector can lead to remote class loading and root remote code execution. No CVE or observed exploitation is stated.

Full Disclosure04:12 UTC · 4h agoVulnerability 2 sources

Lightstreamer

Timeline2 articles

Appears with

[0day-rubbish] Lightstreamer Server 7.4.8 Unauthenticated JMX jvmtiAgentLoad native code execution (8.1)

[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)