PT-2015-1267 · Oracle+6 · Java Se+7

Published 2015-01-20 · Updated 2024-06-15 · CVE-2015-0408

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE versions 5.0u75, 6u85, 7u72, and 8u25

Description The issue allows a remote attacker to compromise confidentiality, integrity, and availability using vectors related to the Remote Method Invocation (RMI) interface.

Recommendations For Java SE version 5.0u75, update to a version that is not affected by this issue. For Java SE version 6u85, update to a version that is not affected by this issue. For Java SE version 7u72, update to a version that is not affected by this issue. For Java SE version 8u25, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the RMI interface until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-10291

CESA-2015_0067

CESA-2015_0069

CESA-2015_0085

CVE-2015-0408

DLA-157-1

DSA-3144-1

DSA-3147-1

HPSBUX03273

HPSBUX03281

MGASA-2015-0037

OPENSUSE-SU-2015_0190-1

OPENSUSE-SU-2024:10534-1

RHSA-2015:0067

RHSA-2015:0068

RHSA-2015:0069

RHSA-2015:0079

RHSA-2015:0080

RHSA-2015:0085

RHSA-2015:0086

RHSA-2015:0133

RHSA-2015:0134

RHSA-2015:0135

RHSA-2015:0136

RHSA-2015:0263

RHSA-2015:0264

RHSA-2015_0067

RHSA-2015_0068

RHSA-2015_0069

RHSA-2015_0079

RHSA-2015_0080

RHSA-2015_0085

RHSA-2015_0086

RHSA-2015_0133

RHSA-2015_0135

RHSA-2015_0136

SUSE-SU-2015:0503-1

USN-2486-1

USN-2487-1

Affected Products

Centos

Hp-Ux

Ibm Aix

Java Platform

Java Se

Red Hat

Suse

Ubuntu

References · 473

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/ssl_version.rb · Exploit
• 🔥 https://github.com/mpgn/poodle-PoC · Exploit
• https://bdu.fstec.ru/vul/2015-00642 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2487-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0408 · Security Note
• https://ubuntu.com/security/CVE-2015-0395 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0086.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0395 · Security Note
• https://osv.dev/vulnerability/USN-2487-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0437 · Security Note