CVE-2014-0368: Medium severity Oracle JDK vulnerability
A flaw was found in the way the Networking component of OpenJDK checked permissions of code to listen on network ports. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45, and Java SE Embedded 7u45, allows remote attackers to affect confidentiality via unknown vectors related to Networking. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to incorrect permission checks when listening on a socket, which allows attackers to escape the sandbox.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.3.13 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.12.8 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0368?
CVE-2014-0368 is classified as a moderate severity vulnerability allowing untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2014-0368?
To fix CVE-2014-0368, upgrade to the latest version of IcedTea or the Oracle Java versions that are no longer vulnerable.
What software is affected by CVE-2014-0368?
CVE-2014-0368 affects specific versions of Oracle JDK and JRE as well as multiple versions of the IcedTea package.
What type of attack can CVE-2014-0368 facilitate?
CVE-2014-0368 can facilitate attacks that allow malicious Java code to listen on network ports, bypassing security restrictions.
Is CVE-2014-0368 specific to a particular Java version?
Yes, CVE-2014-0368 specifically affects Oracle Java SE versions 5.0u55, 6u65, and 7u45 among others.