PT-2016-3195 · Ibm+2 · Ibm J9 Vm+3

Publicado 2016-11-30 · Atualizado 2019-10-03 · CVE-2017-1376

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM J9 VM (affected versions not specified) Oracle Java SE (affected versions not specified)

Description The issue is related to a flaw in the class verifier of the IBM J9 VM, which is associated with inadequate access control. This flaw can be exploited by a remote attacker to disable the security manager and elevate privileges. The vulnerability may allow an unauthenticated attacker to cause low confidentiality impact, no integrity impact, and low availability impact.

Recommendations For IBM J9 VM, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Oracle Java SE, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

CWE-829

Identificadores relacionados

BDU:2017-02408

CVE-2017-1376

RHSA-2017:2469

RHSA-2017:2481

RHSA-2017_2469

RHSA-2017_2481

Produtos afetados

Ibm Aix

Ibm J9 Vm

Java Se

Red Hat

Referências · 8

• http://ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2469 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/126873 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1376 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1376 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E · Nota
• https://bdu.fstec.ru/vul/2017-02408 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:2481 · Aviso do Fabricante