CVE-2014-1876
First published: Mon Feb 03 2014(Updated: )
Jakub Wilk reported in a Debian bug report [1] that the unpack200 program included in OpenJDK did not properly handle the logfile properly. If the the log file was unable to be opened, it would create /tmp/unpack.log instead as the fallback, but do so in an insecure manner, as shown in unpack.cpp (the below is from OpenJDK 6): 4732 void unpacker::redirect_stdio() { ... 4757 #else 4758 sprintf(tmpdir,"/tmp"); 4759 sprintf(log_file_name, "/tmp/unpack.log"); 4760 #endif 4761 if ((errstrm = fopen(log_file_name, "a+")) != NULL) { 4762 log_file = errstrm_name = saveStr(log_file_name); 4763 return ; 4764 } 4765 4766 char *tname = tempnam(tmpdir,"#upkg"); 4767 sprintf(log_file_name, "%s", tname); 4768 if ((errstrm = fopen(log_file_name, "a+")) != NULL) { 4769 log_file = errstrm_name = saveStr(log_file_name); 4770 return ; 4771 } The same exists in OpenJDK 7 and 8. This could allow a malicious local attacker to conduct local attacks, such as symlink attacks, where a file could be overwritten if the user running unpack200 had write permissions. [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 | 1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 |
| redhat/java | <1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10 | 1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10 |
| redhat/java | <1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 | 1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 |
| redhat/java | <1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5 | 1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5 |
| redhat/java | <1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el5_10 | 1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el5_10 |
| redhat/java | <1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el5_10 | 1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el5_10 |
| redhat/java | <1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el6_5 | 1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el6_5 |
| redhat/java | <1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el6_5 | 1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el6_5 |
| redhat/java | <1.7.0-openjdk-1:1.7.0.55-2.4.7.2.el7_0 | 1.7.0-openjdk-1:1.7.0.55-2.4.7.2.el7_0 |
| redhat/java | <1.6.0-openjdk-1:1.6.0.0-6.1.13.3.el7_0 | 1.6.0-openjdk-1:1.6.0.0-6.1.13.3.el7_0 |
| redhat/java | <1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5 | 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5 |
| redhat/java | <1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el5_10 | 1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el5_10 |
| redhat/java | <1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5_10 | 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5_10 |
| redhat/java | <1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el5_10 | 1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el5_10 |
| redhat/java | <1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el6_5 | 1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el6_5 |
| redhat/java | <1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6_5 | 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6_5 |
| redhat/java | <1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el6_5 | 1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el6_5 |
| redhat/java | <1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0 | 1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0 |
| redhat/icedtea | <1.13.3 | 1.13.3 |
| redhat/icedtea | <2.4.7 | 2.4.7 |
| Oracle OpenJDK | =1.6.0 | |
| Oracle OpenJDK | =1.7.0 | |
| Oracle OpenJDK | =1.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562
- https://access.redhat.com/security/cve/CVE-2014-1876
- http://openwall.com/lists/oss-security/2014/02/08/1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1060907#c0
- http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027214.html
- http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-April/027222.html
- https://rhn.redhat.com/errata/RHSA-2014-0407.html
- https://rhn.redhat.com/errata/RHSA-2014-0406.html
- https://rhn.redhat.com/errata/RHSA-2014-0408.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1060907#c2
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/ce81e69d561d
- https://rhn.redhat.com/errata/RHSA-2014-0413.html
- https://rhn.redhat.com/errata/RHSA-2014-0412.html
- https://rhn.redhat.com/errata/RHSA-2014-0414.html
- https://rhn.redhat.com/errata/RHSA-2014-0486.html
- https://rhn.redhat.com/errata/RHSA-2014-0508.html
- https://rhn.redhat.com/errata/RHSA-2014-0509.html
- https://rhn.redhat.com/errata/RHSA-2014-0675.html
- https://rhn.redhat.com/errata/RHSA-2014-0685.html
- https://rhn.redhat.com/errata/RHSA-2014-0705.html
- https://rhn.redhat.com/errata/RHSA-2014-0982.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1060907
- https://www.cve.org/CVERecord?id=CVE-2014-1876 https://nvd.nist.gov/vuln/detail/CVE-2014-1876 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2014:0413
- https://access.redhat.com/errata/RHSA-2014:0414
- https://access.redhat.com/errata/RHSA-2014:0407
- https://access.redhat.com/errata/RHSA-2014:0408
- https://access.redhat.com/errata/RHSA-2014:0406
- https://access.redhat.com/errata/RHSA-2014:0675
- https://access.redhat.com/errata/RHSA-2014:0685
- https://access.redhat.com/errata/RHSA-2014:0982
- https://access.redhat.com/errata/RHSA-2014:0412
- https://access.redhat.com/errata/RHSA-2014:0486
- https://access.redhat.com/errata/RHSA-2014:0508
- https://access.redhat.com/errata/RHSA-2014:0509
- https://access.redhat.com/errata/RHSA-2014:0705
- http://marc.info/?l=bugtraq&m=140852886808946&w=2
- http://marc.info/?l=bugtraq&m=140852974709252&w=2
- http://osvdb.org/102808
- http://rhn.redhat.com/errata/RHSA-2014-0675.html
- http://rhn.redhat.com/errata/RHSA-2014-0685.html
- http://seclists.org/oss-sec/2014/q1/242
- http://seclists.org/oss-sec/2014/q1/285
- http://secunia.com/advisories/58415
- http://secunia.com/advisories/59058
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www-01.ibm.com/support/docview.wss?uid=swg21672080
- http://www-01.ibm.com/support/docview.wss?uid=swg21676746
- http://www-01.ibm.com/support/docview.wss?uid=swg21679713
- http://www.debian.org/security/2014/dsa-2912
- http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
- http://www.securityfocus.com/bid/65568
- http://www.ubuntu.com/usn/USN-2187-1
- http://www.ubuntu.com/usn/USN-2191-1
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-1876
- agent/software-canonical-lookup
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/oracle
- canonical/oracle openjdk
- version/oracle openjdk/1.6.0
- version/oracle openjdk/1.7.0
- version/oracle openjdk/1.8.0