CVE-2014-4262: Critical severity Oracle JDK vulnerability

Published Mar 12, 2014

Updated

Florian Weimer discovered that AtomicReferenceFieldUpdater in OpenJDK does not properly check if the field to be updated is of primitive type. An untrusted Java application or applet could use flaw to trigger Java virtual machine memory corruption and possibly bypass Java sandbox restrictions.

AtomicReferenceFieldUpdater API documentation: http://docs.oracle.com/javase/7/docs/api/java/util/concurrent/atomic/AtomicReferenceFieldUpdater.html

This issue is mitigated by the bug that prevents AtomicFieldUpdater instances when code runs under security manager restrictions under OpenJDK and Oracle JDK 6 and 7. The bug was fixed in JDK8:

http://bugs.java.com/bugdatabase/viewbug.do?bugid=7103570 http://bugs.java.com/bugdatabase/viewbug.do?bugid=7131655 http://hg.openjdk.java.net/jdk8/tl/jdk/rev/48513d156965

Acknowledgement:

This issue was discovered by Florian Weimer of Red Hat Product Security.

Other sources

Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

Affected Software

8 affected components

Oracle JDK=1.5.0-update65

Oracle JDK=1.6.0-update75

Oracle JDK=1.7.0-update60

Oracle JDK=1.8.0-update5

ORACLE JRE=1.5.0-update65

ORACLE JRE=1.6.0-update75

ORACLE JRE=1.7.0-update60

ORACLE JRE=1.8.0-update5

Event History

Mar 12, 2014

Data Sourced

via Red Hat·08:13 PM

DescriptionSeverityAffected Software

Jul 17, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4262?

The severity of CVE-2014-4262 is classified as critical due to memory corruption vulnerabilities that could allow untrusted applications to bypass Java sandboxing.

How do I fix CVE-2014-4262?

To fix CVE-2014-4262, update your OpenJDK or Oracle JDK to the latest version that addresses this vulnerability.

Which software versions are affected by CVE-2014-4262?

CVE-2014-4262 affects multiple versions of Oracle JDK and JRE from 1.5.0-update65 to 1.8.0-update5.

What are the potential impacts of CVE-2014-4262?

The potential impacts of CVE-2014-4262 include memory corruption and the ability for untrusted applications to execute code outside of the Java sandbox.

Is CVE-2014-4262 exploitable remotely?

Yes, CVE-2014-4262 is exploitable remotely through malicious Java applications or applets.