PT-2017-3118 · Ibm+1 · Aix+3

Published 2017-09-01 · Updated 2017-11-02 · CVE-2017-1541

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AIX versions 5.3, 6.1, 7.1, and 7.2

Description The issue is related to a flaw in the JRE/SDK installp and updatep packages, which prevented the java.security, java.policy, and javaws.policy files from being updated correctly. This is due to insufficient input validation, allowing a remote attacker to impact the update procedure of these files. The vulnerability could allow an unauthenticated attacker to cause low confidentiality impact, no integrity impact, and low availability impact.

Recommendations For AIX versions 5.3, 6.1, 7.1, and 7.2, update the JRE/SDK installp and updatep packages to ensure the java.security, java.policy, and javaws.policy files are updated correctly. As a temporary workaround, consider restricting access to the update procedure of the java.security, java.policy, and javaws.policy files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-02518

CVE-2017-1541

Affected Products

Aix

Ibm Aix

Jre

Sdk

References · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/130809 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1541 · Security Note
• https://bdu.fstec.ru/vul/2017-02518 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1541 · Vendor Advisory
• http://aix.software.ibm.com/aix/efixes/security/java_july2017_advisory.asc · Vendor Advisory
• http://securityfocus.com/bid/100915 · Note
• http://securityfocus.com/bid/100914 · Note
• http://aix.software.ibm.com/aix/efixes/security/java6_advisory.asc · Note
• http://securitytracker.com/id/1039372 · Note