CVE-2014-0411: Medium severity ORACLE Jrockit vulnerability

Published Jan 14, 2014
·
Updated

It was discovered that the JSSE component in OpenJDK could leak some timing information during the TLS/SSL handshake. This could possibly lead to disclosure of some information about negotiated encryption keys.

Other sources

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.

Affected Software

27 affected componentsFixes available
redhat/java<1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10
1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10
redhat/java<1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5
1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5
redhat/java<1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10
1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10
redhat/java<1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el5_10
1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el5_10
redhat/java<1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5
1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5
redhat/java<1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el6_5
1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el6_5
redhat/java<1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5
1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5
redhat/java<1.7.0-oracle-1:1.7.0.51-1jpp.1.el5_10
1.7.0-oracle-1:1.7.0.51-1jpp.1.el5_10
redhat/java<1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10
1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10
redhat/java<1.6.0-ibm-1:1.6.0.15.1-1jpp.1.el5_10
1.6.0-ibm-1:1.6.0.15.1-1jpp.1.el5_10
redhat/java<1.5.0-ibm-1:1.5.0.16.5-1jpp.1.el5_10
1.5.0-ibm-1:1.5.0.16.5-1jpp.1.el5_10
redhat/java<1.7.0-oracle-1:1.7.0.51-1jpp.1.el6_5
1.7.0-oracle-1:1.7.0.51-1jpp.1.el6_5
redhat/java<1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5
1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5
redhat/java<1.6.0-ibm-1:1.6.0.15.1-1jpp.1.el6_5
1.6.0-ibm-1:1.6.0.15.1-1jpp.1.el6_5
redhat/java<1.5.0-ibm-1:1.5.0.16.5-1jpp.1.el6_5
1.5.0-ibm-1:1.5.0.16.5-1jpp.1.el6_5
redhat/java<1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0
1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0
redhat/icedtea<2.4.4
2.4.4
redhat/icedtea<2.3.13
2.3.13
redhat/icedtea<1.12.8
1.12.8
redhat/icedtea<1.13.1
1.13.1
ORACLE Jrockit=r27.7.7
ORACLE Jrockit=r28.2.9
ORACLE JRE=1.7.0-update45
Oracle JDK=1.5.0-update55
ORACLE JRE=1.5.0-update55
Oracle JDK=1.6.0-update65
ORACLE JRE=1.6.0-update65

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10
  2. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5
  3. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10
  4. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el5_10
  5. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5
  6. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el6_5
  7. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5
  8. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.51-1jpp.1.el5_10
  9. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el5_10
  10. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.15.1-1jpp.1.el5_10
  11. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.5.0-ibm-1:1.5.0.16.5-1jpp.1.el5_10
  12. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.51-1jpp.1.el6_5
  13. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-ibm-1:1.7.0.6.1-1jpp.1.el6_5
  14. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.15.1-1jpp.1.el6_5
  15. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.5.0-ibm-1:1.5.0.16.5-1jpp.1.el6_5
  16. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0
  17. Upgrade

    Upgrade redhat/icedtea to a version that resolves this vulnerability.

    Fixed in 2.4.4
  18. Upgrade

    Upgrade redhat/icedtea to a version that resolves this vulnerability.

    Fixed in 2.3.13
  19. Upgrade

    Upgrade redhat/icedtea to a version that resolves this vulnerability.

    Fixed in 1.12.8
  20. Upgrade

    Upgrade redhat/icedtea to a version that resolves this vulnerability.

    Fixed in 1.13.1

Event History

Jan 14, 2014
CVE Published
12:00 AM
Jan 15, 2014
CVE Published
via MITRE·02:50 AM
Data Sourced
via MITRE·02:50 AM
Description
Data Sourced
via NVD·04:08 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2014-0411?

CVE-2014-0411 has been classified as a medium severity vulnerability due to potential exposure of sensitive information during TLS/SSL handshakes.

2

How do I fix CVE-2014-0411?

To fix CVE-2014-0411, update to the latest versions of Java and OpenJDK recommended in the security advisories corresponding to your system.

3

Which software versions are affected by CVE-2014-0411?

CVE-2014-0411 affects Oracle Java SE versions 5.0u55, 6u65, 7u45 and various versions of JRockit, as well as OpenJDK packages.

4

What are the risks associated with CVE-2014-0411?

The risks associated with CVE-2014-0411 include the potential disclosure of negotiation keys used during secure communications.

5

When was CVE-2014-0411 disclosed?

CVE-2014-0411 was disclosed in January 2014 as part of multiple security updates for Java applications.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203