VYPR
← All advisories
High severityNVD Advisory· Published Jul 11, 2013· Updated Apr 29, 2026

CVE-2013-1777

CVE-2013-1777

Description

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.geronimo.framework:geronimo-jmx-remotingMaven
>= 3.0-beta-1, < 3.0.13.0.1

Affected products

4
  • Apache/Geronimo3 versions
    cpe:2.3:a:apache:geronimo:3.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apache:geronimo:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:geronimo:3.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:apache:geronimo:3.0:m1:*:*:*:*:*:*
  • IBM/Websphere Application Server
    cpe:2.3:a:ibm:websphere_application_server:3.0.0.3:-:community:*:*:*:*:*

Patches

1
ee031c5e62b0

set better classloader for jmx

https://github.com/apache/geronimoJarek GaworMar 19, 2013via ghsa
commit
2 files changed · +13 −4
  • framework/modules/geronimo-jmx-remoting/src/main/java/org/apache/geronimo/jmxremoting/JMXConnector.java+4 −2 modified
    @@ -192,21 +192,23 @@ public void doStart() throws Exception {
         if (applicationConfigName != null) {
             authenticator = new Authenticator(applicationConfigName, classLoader);
             String accessconfig = serverInfo.resolveServerPath("var/security/jmx_access.properties");
-	    env.put("jmx.remote.x.access.file",accessconfig);
+            env.put("jmx.remote.x.access.file", accessconfig);
             env.put(JMXConnectorServer.AUTHENTICATOR, authenticator);
         } else {
             log.warn("Starting unauthenticating JMXConnector for " + jmxServiceURL);
         }
         RMIServerSocketFactory serverSocketFactory = new GeronimoRMIServerSocketFactory(host);
         env.put(RMIConnectorServer.RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE, serverSocketFactory);
+        
         server = JMXConnectorServerFactory.newJMXConnectorServer(jmxServiceURL, env, mbeanServer);
         NotificationFilterSupport filter = new NotificationFilterSupport();
         filter.enableType(JMXConnectionNotification.OPENED);
         filter.enableType(JMXConnectionNotification.CLOSED);
         filter.enableType(JMXConnectionNotification.FAILED);
         server.addNotificationListener(authenticator, filter, null);
+        
         ClassLoader oldCl = Thread.currentThread().getContextClassLoader();
-        Thread.currentThread().setContextClassLoader(classLoader);
+        Thread.currentThread().setContextClassLoader(getClass().getClassLoader());
         try {
             server.start();
         } finally {
  • framework/modules/geronimo-jmx-remoting/src/main/java/org/apache/geronimo/jmxremoting/JMXSecureConnector.java+9 −2 modified
    @@ -139,7 +139,7 @@ public void doStart() throws Exception {
         if (applicationConfigName != null) {
             authenticator = new Authenticator(applicationConfigName, classLoader);
             String accessconfig = serverInfo.resolveServerPath("var/security/jmx_access.properties");
-	    env.put("jmx.remote.x.access.file",accessconfig);
+            env.put("jmx.remote.x.access.file", accessconfig);
             env.put(JMXConnectorServer.AUTHENTICATOR, authenticator);
         } else {
             log.warn("Starting unauthenticating JMXConnector for " + jmxServiceURL);
@@ -157,7 +157,14 @@ public void doStart() throws Exception {
         filter.enableType(JMXConnectionNotification.CLOSED);
         filter.enableType(JMXConnectionNotification.FAILED);
         server.addNotificationListener(authenticator, filter, null);
-        server.start();
+        
+        ClassLoader oldCl = Thread.currentThread().getContextClassLoader();
+        Thread.currentThread().setContextClassLoader(getClass().getClassLoader());
+        try {
+            server.start();
+        } finally {
+            Thread.currentThread().setContextClassLoader(oldCl);
+        }
         log.debug("Started JMXConnector " + server.getAddress());
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.