PT-2015-4110 · Ibm+2 · Ibm Sdk+3

Tomas Hoger · Publicado 2015-02-05 · Atualizado 2019-07-16 · CVE-2014-8891

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM SDK, Java Technology Edition versions 5.0 before SR16-FP9 IBM SDK, Java Technology Edition versions 6 before SR16-FP3 IBM SDK, Java Technology Edition versions 6R1 before SR8-FP3 IBM SDK, Java Technology Edition versions 7 before SR8-FP10 IBM SDK, Java Technology Edition versions 7R1 before SR2-FP10

Description The issue allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager. This is part of a broader set of vulnerabilities addressed in Oracle's February 2015 Critical Patch Update.

Recommendations For IBM SDK, Java Technology Edition version 5.0, update to SR16-FP9 or later. For IBM SDK, Java Technology Edition version 6, update to SR16-FP3 or later. For IBM SDK, Java Technology Edition version 6R1, update to SR8-FP3 or later. For IBM SDK, Java Technology Edition version 7, update to SR8-FP10 or later. For IBM SDK, Java Technology Edition version 7R1, update to SR2-FP10 or later.

Exploit

Correção

Identificadores relacionados

CVE-2014-8891

RHSA-2015:0133

RHSA-2015:0134

RHSA-2015:0135

RHSA-2015:0136

RHSA-2015:0263

RHSA-2015:0264

RHSA-2015_0133

RHSA-2015_0135

RHSA-2015_0136

SUSE-SU-2015:0304-1

SUSE-SU-2015:0306-1

SUSE-SU-2015_0304-1

SUSE-SU-2015_0306-1

SUSE-SU-2015_0343-1

SUSE-SU-2015_0344-1

SUSE-SU-2015_0345-1

SUSE-SU-2015_0376-1

SUSE-SU-2015_0392-1

Produtos afetados

Ibm Aix

Ibm Sdk

Red Hat

Suse

Referências · 120

• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Nota
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb · Nota
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ssl_version.rb · Nota
• https://github.com/stdevel/poodle_protector · Nota
• https://bdu.fstec.ru/vul/2015-00553 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00548 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00591 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00558 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00590 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00642 · Nota de Segurança
• https://www-304.ibm.com/support/docview.wss?uid=swg21695474 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2015-0408 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00022.html · Aviso do Fabricante