CVE-2017-3241

27.01.2017, 22:59

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9 CRITICAL	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Affected Products (NVD)

Vendor	Product	Version
oracle	jdk	1.6
oracle	jdk	1.7
oracle	jdk	1.8
oracle	jdk	1.8
oracle	jre	1.6
oracle	jre	1.7
oracle	jre	1.8
oracle	jre	1.8
oracle	jrockit	r28.3.12

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

openjdk-8

sid	8u432-b06-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

openjdk-6

precise	Fixed 6b41-1.13.13-0ubuntu0.12.04.1 released
trusty	Fixed 6b41-1.13.13-0ubuntu0.14.04.1 released
xenial	dne
yakkety	dne

openjdk-7

precise	Fixed 7u121-2.6.8-1ubuntu0.12.04.3 released
trusty	Fixed 7u121-2.6.8-1ubuntu0.14.04.3 released
xenial	dne
yakkety	dne

openjdk-8

precise	dne
trusty	dne
xenial	Fixed 8u121-b13-0ubuntu1.16.04.2 released
yakkety	Fixed 8u121-b13-0ubuntu1.16.10.2 released

openSUSE / SLES Releases

openSUSE Product

Release

java-1_7_0-openjdk

suse enterprise sap 12 SP1	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP2	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.131-39.1 fixed
suse enterprise server 12 SP1	1.7.0.131-39.1 fixed
suse enterprise server 12 SP2	1.7.0.131-39.1 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-demo

suse enterprise sap 12 SP1	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP2	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.131-39.1 fixed
suse enterprise server 12 SP1	1.7.0.131-39.1 fixed
suse enterprise server 12 SP2	1.7.0.131-39.1 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-devel

suse enterprise sap 12 SP1	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP2	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.131-39.1 fixed
suse enterprise server 12 SP1	1.7.0.131-39.1 fixed
suse enterprise server 12 SP2	1.7.0.131-39.1 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-headless

suse enterprise sap 12 SP1	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP2	1.7.0.131-39.1 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12	1.7.0.131-39.1 fixed
suse enterprise server 12 SP1	1.7.0.131-39.1 fixed
suse enterprise server 12 SP2	1.7.0.131-39.1 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_8_0-openjdk

suse enterprise sap 12 SP1	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP2	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.161-1.52 fixed
suse enterprise sap 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise sap 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise sap 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise sap 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise sap 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise sap 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise sap 15 SP7	1.8.0.442-150000.3.103.2 fixed
suse enterprise server 12 SP1	1.8.0.121-20.1 fixed
suse enterprise server 12 SP2	1.8.0.121-20.1 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.161-1.52 fixed
suse enterprise server 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise server 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise server 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise server 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise server 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise server 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise server 15 SP7	1.8.0.442-150000.3.103.2 fixed

java-1_8_0-openjdk-demo

suse enterprise sap 12 SP1	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP2	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.161-1.52 fixed
suse enterprise sap 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise sap 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise sap 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise sap 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise sap 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise sap 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise sap 15 SP7	1.8.0.442-150000.3.103.2 fixed
suse enterprise server 12 SP1	1.8.0.121-20.1 fixed
suse enterprise server 12 SP2	1.8.0.121-20.1 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.161-1.52 fixed
suse enterprise server 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise server 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise server 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise server 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise server 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise server 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise server 15 SP7	1.8.0.442-150000.3.103.2 fixed

java-1_8_0-openjdk-devel

suse enterprise sap 12 SP1	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP2	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.161-1.52 fixed
suse enterprise sap 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise sap 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise sap 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise sap 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise sap 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise sap 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise sap 15 SP7	1.8.0.442-150000.3.103.2 fixed
suse enterprise server 12 SP1	1.8.0.121-20.1 fixed
suse enterprise server 12 SP2	1.8.0.121-20.1 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.161-1.52 fixed
suse enterprise server 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise server 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise server 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise server 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise server 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise server 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise server 15 SP7	1.8.0.442-150000.3.103.2 fixed

java-1_8_0-openjdk-headless

suse enterprise sap 12 SP1	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP2	1.8.0.121-20.1 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.161-1.52 fixed
suse enterprise sap 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise sap 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise sap 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise sap 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise sap 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise sap 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise sap 15 SP7	1.8.0.442-150000.3.103.2 fixed
suse enterprise server 12 SP1	1.8.0.121-20.1 fixed
suse enterprise server 12 SP2	1.8.0.121-20.1 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.161-1.52 fixed
suse enterprise server 15 SP1	1.8.0.201-3.16.1 fixed
suse enterprise server 15 SP2	1.8.0.242-3.30.2 fixed
suse enterprise server 15 SP3	1.8.0.282-3.48.1 fixed
suse enterprise server 15 SP4	1.8.0.322-3.64.2 fixed
suse enterprise server 15 SP5	1.8.0.362-150000.3.76.1 fixed
suse enterprise server 15 SP6	1.8.0.412-150000.3.91.1 fixed
suse enterprise server 15 SP7	1.8.0.442-150000.3.103.2 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

java-1.6.0-ibm

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.6.0-ibm-demo

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.6.0-ibm-devel

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.6.0-ibm-javacomm

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.6.0-ibm-jdbc

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.6.0-ibm-plugin

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.6.0-ibm-src

RHEL 6

1:1.6.0.16.41-1jpp.1.el6_8

fixed

java-1.7.0-openjdk

RHEL 6	1:1.7.0.131-2.6.9.0.el6_8 fixed
RHEL 7	1:1.7.0.131-2.6.9.0.el7_3 fixed

java-1.7.0-openjdk-accessibility

RHEL 7

1:1.7.0.131-2.6.9.0.el7_3

fixed

java-1.7.0-openjdk-demo

RHEL 6	1:1.7.0.131-2.6.9.0.el6_8 fixed
RHEL 7	1:1.7.0.131-2.6.9.0.el7_3 fixed

java-1.7.0-openjdk-devel

RHEL 6	1:1.7.0.131-2.6.9.0.el6_8 fixed
RHEL 7	1:1.7.0.131-2.6.9.0.el7_3 fixed

java-1.7.0-openjdk-headless

RHEL 7

1:1.7.0.131-2.6.9.0.el7_3

fixed

java-1.7.0-openjdk-javadoc

RHEL 6	1:1.7.0.131-2.6.9.0.el6_8 fixed
RHEL 7	1:1.7.0.131-2.6.9.0.el7_3 fixed

java-1.7.0-openjdk-src

RHEL 6	1:1.7.0.131-2.6.9.0.el6_8 fixed
RHEL 7	1:1.7.0.131-2.6.9.0.el7_3 fixed

java-1.7.1-ibm

RHEL 6	1:1.7.1.4.1-1jpp.1.el6_8 fixed
RHEL 7	1:1.7.1.4.1-1jpp.2.el7 fixed

java-1.7.1-ibm-demo

RHEL 6	1:1.7.1.4.1-1jpp.1.el6_8 fixed
RHEL 7	1:1.7.1.4.1-1jpp.2.el7 fixed

java-1.7.1-ibm-devel

RHEL 6	1:1.7.1.4.1-1jpp.1.el6_8 fixed
RHEL 7	1:1.7.1.4.1-1jpp.2.el7 fixed

java-1.7.1-ibm-jdbc

RHEL 6	1:1.7.1.4.1-1jpp.1.el6_8 fixed
RHEL 7	1:1.7.1.4.1-1jpp.2.el7 fixed

java-1.7.1-ibm-plugin

RHEL 6	1:1.7.1.4.1-1jpp.1.el6_8 fixed
RHEL 7	1:1.7.1.4.1-1jpp.2.el7 fixed

java-1.7.1-ibm-src

RHEL 6	1:1.7.1.4.1-1jpp.1.el6_8 fixed
RHEL 7	1:1.7.1.4.1-1jpp.2.el7 fixed

java-1.8.0-ibm

RHEL 6	1:1.8.0.4.0-1jpp.1.el6_8 fixed
RHEL 7	1:1.8.0.4.0-1jpp.1.el7 fixed

java-1.8.0-ibm-demo

RHEL 6	1:1.8.0.4.0-1jpp.1.el6_8 fixed
RHEL 7	1:1.8.0.4.0-1jpp.1.el7 fixed

java-1.8.0-ibm-devel

RHEL 6	1:1.8.0.4.0-1jpp.1.el6_8 fixed
RHEL 7	1:1.8.0.4.0-1jpp.1.el7 fixed

java-1.8.0-ibm-jdbc

RHEL 6	1:1.8.0.4.0-1jpp.1.el6_8 fixed
RHEL 7	1:1.8.0.4.0-1jpp.1.el7 fixed

java-1.8.0-ibm-plugin

RHEL 6	1:1.8.0.4.0-1jpp.1.el6_8 fixed
RHEL 7	1:1.8.0.4.0-1jpp.1.el7 fixed

java-1.8.0-ibm-src

RHEL 6	1:1.8.0.4.0-1jpp.1.el6_8 fixed
RHEL 7	1:1.8.0.4.0-1jpp.1.el7 fixed

java-1.8.0-openjdk

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-accessibility

RHEL 7

1:1.8.0.121-0.b13.el7_3

fixed

java-1.8.0-openjdk-accessibility-debug

RHEL 7

1:1.8.0.121-0.b13.el7_3

fixed

java-1.8.0-openjdk-debug

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-demo

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-demo-debug

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-devel

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-devel-debug

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-headless

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-headless-debug

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-javadoc

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-javadoc-debug

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-javadoc-zip

RHEL 7

1:1.8.0.121-0.b13.el7_3

fixed

java-1.8.0-openjdk-javadoc-zip-debug

RHEL 7

1:1.8.0.121-0.b13.el7_3

fixed

java-1.8.0-openjdk-src

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

java-1.8.0-openjdk-src-debug

RHEL 6	1:1.8.0.121-0.b13.el6_8 fixed
RHEL 7	1:1.8.0.121-0.b13.el7_3 fixed

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

http://rhn.redhat.com/errata/RHSA-2017-0175.html

http://rhn.redhat.com/errata/RHSA-2017-0176.html

http://rhn.redhat.com/errata/RHSA-2017-0177.html

http://rhn.redhat.com/errata/RHSA-2017-0180.html

http://rhn.redhat.com/errata/RHSA-2017-0263.html

http://rhn.redhat.com/errata/RHSA-2017-0269.html

http://rhn.redhat.com/errata/RHSA-2017-0336.html

http://rhn.redhat.com/errata/RHSA-2017-0337.html

http://rhn.redhat.com/errata/RHSA-2017-0338.html

http://www.debian.org/security/2017/dsa-3782

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html

http://www.securityfocus.com/bid/95488

http://www.securitytracker.com/id/1037637

https://access.redhat.com/errata/RHSA-2017:1216

https://erpscan.io/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/

https://security.gentoo.org/glsa/201701-65

https://security.gentoo.org/glsa/201707-01

https://security.netapp.com/advisory/ntap-20170119-0001/

https://www.exploit-db.com/exploits/41145/

http://rhn.redhat.com/errata/RHSA-2017-0175.html

http://rhn.redhat.com/errata/RHSA-2017-0176.html

http://rhn.redhat.com/errata/RHSA-2017-0177.html

http://rhn.redhat.com/errata/RHSA-2017-0180.html

http://rhn.redhat.com/errata/RHSA-2017-0263.html

http://rhn.redhat.com/errata/RHSA-2017-0269.html

http://rhn.redhat.com/errata/RHSA-2017-0336.html

http://rhn.redhat.com/errata/RHSA-2017-0337.html

http://rhn.redhat.com/errata/RHSA-2017-0338.html

http://www.debian.org/security/2017/dsa-3782

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html

http://www.securityfocus.com/bid/95488

http://www.securitytracker.com/id/1037637

https://access.redhat.com/errata/RHSA-2017:1216

https://erpscan.io/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/

https://security.gentoo.org/glsa/201701-65

https://security.gentoo.org/glsa/201707-01

https://security.netapp.com/advisory/ntap-20170119-0001/

https://www.exploit-db.com/exploits/41145/