CVE-2017-5878

Critical

Published: 08/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Red5 Media Server versions before 1.0.8 have an issue with deserialization as they do not restrict the classes for which deserialization is performed. This allows remote attackers to execute arbitrary code via crafted Java data.

Risk Assessment

Attackers can exploit this vulnerability to execute remote code, potentially leading to server takeover and access to sensitive data.

Recommendation

It is recommended to upgrade Red5 Media Server to version 1.0.8 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.