PT-2015-3051 · Oracle · Openjdk

Publicado 2015-04-24 · Atualizado 2015-11-10 · CVE-2014-8873

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenJDK versions 7u79-2.5.5-1~deb8u1

Description The issue is related to a .desktop file in the OpenJDK package, which includes a MIME type registration added to /etc/mailcap. This allows remote attackers to execute arbitrary code via a JAR file.

Recommendations For OpenJDK version 7u79-2.5.5-1~deb8u1, consider removing the MIME type registration from /etc/mailcap to prevent exploitation until a patch is available. As a temporary workaround, restrict the execution of JAR files to minimize the risk of arbitrary code execution.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00256

CVE-2014-8873

DSA-3235-1

DSA-3316-1

Produtos afetados

Openjdk

Referências · 60

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Nota
• https://github.com/fatlan/HAProxy-Keepalived-Sec-HighLoads · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0470 · Nota de Segurança
• http://debian.org/security/2015/dsa-3235 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2632 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2613 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09950 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0460 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11042 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4733 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-3316-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4749 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09962 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2625 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0477 · Nota de Segurança