PT-2014-1654 · Oracle+4 · Java Se+5

Publicado 2014-10-14 · Atualizado 2020-09-08 · CVE-2014-6476

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 7u67 through 8u20

Description The issue allows a remote attacker to compromise data integrity using the Deployment subcomponent. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Oracle Java SE versions 7u67 through 8u20, update to a version that is not affected by this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2015-00572

CVE-2014-6476

HPSBUX03218

RHSA-2014:1657

RHSA-2014:1876

RHSA-2014:1880

RHSA-2014:1882

RHSA-2014_1657

RHSA-2014_1880

RHSA-2014_1882

Produtos afetados

Hp-Ux

Ibm Aix

Java Platform

Java Se

Red Hat

Suse

Referências · 102

• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Nota
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ssl_version.rb · Nota
• https://github.com/stdevel/poodle_protector · Nota
• https://bdu.fstec.ru/vul/2015-00553 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00548 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6504 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00591 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6531 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00558 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00590 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21688283 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6527 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4288 · Nota de Segurança
• https://aix.software.ibm.com/aix/efixes/security/java_oct2014_advisory.asc · Nota