PT-2016-3195 · Ibm+2 · Ibm J9 Vm+3

Published 2016-11-30 · Updated 2019-10-03 · CVE-2017-1376

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM J9 VM (affected versions not specified) Oracle Java SE (affected versions not specified)

Description The issue is related to a flaw in the class verifier of the IBM J9 VM, which is associated with inadequate access control. This flaw can be exploited by a remote attacker to disable the security manager and elevate privileges. The vulnerability may allow an unauthenticated attacker to cause low confidentiality impact, no integrity impact, and low availability impact.

Recommendations For IBM J9 VM, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Oracle Java SE, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

CWE-829

Related Identifiers

BDU:2017-02408

CVE-2017-1376

RHSA-2017:2469

RHSA-2017:2481

RHSA-2017_2469

RHSA-2017_2481

Affected Products

Ibm Aix

Ibm J9 Vm

Java Se

Red Hat

References · 8

• http://ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2469 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/126873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1376 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1376 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02408 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2481 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22007305&myns=swgtiv&mynp=OCSSJQQ3&mync=E&cm_sp=swgtiv-_-OCSSJQQ3-_-E · Note