CVE-2014-0416: Medium severity Oracle JDK vulnerability
A flaw was found in the way JAAS (Java Authentication and Authorization Service) handled principals set for Subject. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions via deserialization of Subject.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.3.13 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.12.8 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.1 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 5.0u55 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 6u65 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 7u45 - Upgrade
Upgrade
Java SE Embeddedto a version that resolves this vulnerability.Fixed in 7u45 - Upgrade
Upgrade
OpenJDKto a version that resolves this vulnerability.Fixed in 7
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0416?
CVE-2014-0416 has been classified as a moderate severity vulnerability due to potential bypass of Java sandbox restrictions.
How do I fix CVE-2014-0416?
To fix CVE-2014-0416, update to the latest versions of affected packages, such as icedtea versions above 2.4.4 or Oracle JDK versions above 1.6.0-update65.
What type of vulnerability is CVE-2014-0416?
CVE-2014-0416 is a deserialization vulnerability that allows untrusted Java applications to bypass security constraints.
What versions of Java are affected by CVE-2014-0416?
CVE-2014-0416 affects Oracle JDK and JRE versions 1.5.0-update55, 1.6.0-update65, and 1.7.0-update45.
What impact does CVE-2014-0416 have on Java applications?
The impact of CVE-2014-0416 can allow untrusted Java applications to perform unauthorized actions by escaping the Java sandbox environment.