PT-2017-3118 · Ibm+1 · Aix+3

Publicado 2017-09-01 · Atualizado 2017-11-02 · CVE-2017-1541

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AIX versions 5.3, 6.1, 7.1, and 7.2

Description The issue is related to a flaw in the JRE/SDK installp and updatep packages, which prevented the java.security, java.policy, and javaws.policy files from being updated correctly. This is due to insufficient input validation, allowing a remote attacker to impact the update procedure of these files. The vulnerability could allow an unauthenticated attacker to cause low confidentiality impact, no integrity impact, and low availability impact.

Recommendations For AIX versions 5.3, 6.1, 7.1, and 7.2, update the JRE/SDK installp and updatep packages to ensure the java.security, java.policy, and javaws.policy files are updated correctly. As a temporary workaround, consider restricting access to the update procedure of the java.security, java.policy, and javaws.policy files until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-02518

CVE-2017-1541

Produtos afetados

Aix

Ibm Aix

Jre

Sdk

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/130809 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1541 · Nota de Segurança
• http://securityfocus.com/bid/100915 · Nota
• https://bdu.fstec.ru/vul/2017-02518 · Nota de Segurança
• http://securityfocus.com/bid/100914 · Nota
• https://osv.dev/vulnerability/CVE-2017-1541 · Aviso do Fabricante
• http://aix.software.ibm.com/aix/efixes/security/java6_advisory.asc · Nota
• http://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc · Aviso do Fabricante
• http://securitytracker.com/id/1039372 · Nota