PT-2016-1120 · Oracle · Java Se+1

Stefan Kanthak · Published 2016-02-05 · Updated 2022-05-13 · CVE-2016-0603

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE versions 6u111, 7u95, 8u71, and 8u72

Description The issue allows remote attackers to affect confidentiality, integrity, and availability. It is related to the installation process and may involve an untrusted search path that allows local users to gain privileges via a Trojan horse dll in the application directory. The vulnerability can also be exploited to download arbitrary files by sending a link to them during application installation.

Recommendations For Java SE versions 6u111, 7u95, 8u71, and 8u72, consider disabling the installation functionality related to the vulnerable component until a patch is available. Restrict access to the application directory to minimize the risk of exploitation. Avoid using the application directory for installing applications from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2016-00379

CVE-2016-0603

Affected Products

Java Platform

Java Se

References · 10

• http://oracle.com/technetwork/topics/security/alert-cve-2016-0603-2874360.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0603 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00379 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-0603 · Security Note
• https://security.gentoo.org/glsa/201610-08 · Vendor Advisory
• http://securityfocus.com/archive/1/537462/100/0/threaded · Note
• http://securitytracker.com/id/1034969 · Note
• https://security.netapp.com/advisory/ntap-20160217-0001 · Note
• http://securityfocus.com/bid/83008 · Note
• http://seclists.org/fulldisclosure/2016/Feb/54 · Note