CVE-2017-9830

Critical

Published: 27/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Code42 CrashPlan 5.4.x, remote code execution is possible via the org.apache.commons.ssl.rmi.DateRMI class, which upon instantiation creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code on the server, potentially leading to serious security breaches within the organization.

Recommendation

It is recommended to upgrade to the latest version of Code42 CrashPlan to mitigate this vulnerability and to restrict access to TCP ports used by the RMI server.

Original NVD description (English source)

Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.