CVE-2014-3065: Code Injection

Published Nov 11, 2014

Updated

IBM JDK updates 5.0 SR16-FP8, 6 SR16-FP2, 6R1 SR8-FP2, 7 SR8, and 7R1 SR2 fix a security issue described in the IBM security bulletin as:

IBM Java SDK contains a vulnerability in which the default configuration for the shared classes feature potentially allows arbitrary code to be injected into the shared classes cache, which may subsequently be executed by other local users.

This issue may possibly allow local users to run arbitrary code with the privileges of other users that use IBM JDK.

References: http://www-01.ibm.com/support/docview.wss?uid=swg21688283 http://xforce.iss.net/xforce/xfdb/93629 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateNovember2014

Additional references that describe the shared class cache feature: http://www.ibm.com/developerworks/library/j-ibmjava4/ http://www.ibm.com/developerworks/library/j-sharedclasses/ http://www-01.ibm.com/support/knowledgecenter/SSYKE27.0.0/com.ibm.java.lnx.71.doc/diag/understanding/sharedclasses.html http://www-01.ibm.com/support/knowledgecenter/SSYKE27.0.0/com.ibm.java.lnx.71.doc/diag/appendixes/cmdline/Xshareclasses.html

Other sources

Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache.

— MITRE

Affected Software

46 affected components

IBM JDK=5.0.0.0

IBM JDK=5.0.11.0

IBM JDK=5.0.11.1

IBM JDK=5.0.11.2

IBM JDK=5.0.12.0

IBM JDK=5.0.12.1

IBM JDK=5.0.12.2

IBM JDK=5.0.12.3

IBM JDK=5.0.12.4

IBM JDK=5.0.12.5

IBM JDK=5.0.13.0

IBM JDK=5.0.14.0

IBM JDK=5.0.15.0

IBM JDK=5.0.16.0

IBM JDK=5.0.16.1

IBM JDK=5.0.16.2

IBM JDK=5.0.16.3

IBM JDK=6.0.0.0

IBM JDK=6.0.1.0

IBM JDK=6.0.2.0

IBM JDK=6.0.3.0

IBM JDK=6.0.4.0

IBM JDK=6.0.5.0

IBM JDK=6.0.6.0

IBM JDK=6.0.7.0

IBM JDK=6.0.8.0

IBM JDK=6.0.8.1

IBM JDK=6.0.9.0

IBM JDK=6.0.9.1

IBM JDK=6.0.9.2

IBM JDK=6.0.10.0

IBM JDK=6.0.10.1

IBM JDK=6.0.11.0

IBM JDK=6.0.12.0

IBM JDK=6.0.13.0

IBM JDK=6.0.13.1

IBM JDK=6.0.13.2

IBM JDK=6.0.14.0

IBM JDK=7.0.0.0

IBM JDK=7.0.1.0

IBM JDK=7.0.2.0

IBM JDK=7.0.3.0

IBM JDK=7.0.4.0

IBM JDK=7.0.4.1

IBM JDK=7.0.4.2

IBM JDK=7.0.5.0

Event History

Nov 11, 2014

Data Sourced

via Red Hat·10:08 AM

DescriptionSeverityAffected Software

Dec 2, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3065?

CVE-2014-3065 is rated as a medium-severity vulnerability that allows arbitrary code injection in the IBM Java SDK.

How do I fix CVE-2014-3065?

To fix CVE-2014-3065, you should upgrade to one of the fixed versions of IBM JDK specified in the IBM security bulletin.

What versions of IBM JDK are affected by CVE-2014-3065?

CVE-2014-3065 affects IBM JDK versions 5.0 SR16-FP8, 6 SR16-FP2, 6R1 SR8-FP2, 7 SR8, and 7R1 SR2.

Is CVE-2014-3065 a serious security risk?

Yes, CVE-2014-3065 poses a serious security risk as it allows potential attackers to inject arbitrary code.

What features of IBM JDK are involved in CVE-2014-3065?

CVE-2014-3065 involves a vulnerability in the default configuration of the shared classes feature in IBM JDK.