CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability

Published Apr 18, 2016
·
Updated

It was discovered that the RMI (Java Remote Method Invocation) server implementation in the JMX (Java Management Extensions) component of OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote unauthenticated attacker able to connect to a JMX port could possibly use this flaw trigger deserialization flaws.

Other sources

It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws.

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

— CISA

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Jav ...

— Debian

Affected Software

109 affected componentsFixes available
redhat/java<1.7.0-oracle-1:1.7.0.101-1jpp.1.el5_11
1.7.0-oracle-1:1.7.0.101-1jpp.1.el5_11
redhat/java<1.6.0-sun-1:1.6.0.115-1jpp.1.el5_11
1.6.0-sun-1:1.6.0.115-1jpp.1.el5_11
redhat/java<1.8.0-oracle-1:1.8.0.91-1jpp.1.el6_7
1.8.0-oracle-1:1.8.0.91-1jpp.1.el6_7
redhat/java<1.7.0-oracle-1:1.7.0.101-1jpp.1.el6_7
1.7.0-oracle-1:1.7.0.101-1jpp.1.el6_7
redhat/java<1.6.0-sun-1:1.6.0.115-1jpp.1.el6_7
1.6.0-sun-1:1.6.0.115-1jpp.1.el6_7
redhat/java<1.8.0-oracle-1:1.8.0.91-1jpp.1.el7
1.8.0-oracle-1:1.8.0.91-1jpp.1.el7
redhat/java<1.7.0-oracle-1:1.7.0.101-1jpp.1.el7
1.7.0-oracle-1:1.7.0.101-1jpp.1.el7
redhat/java<1.6.0-sun-1:1.6.0.115-1jpp.1.el7
1.6.0-sun-1:1.6.0.115-1jpp.1.el7
redhat/java<1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el5_11
1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el5_11
redhat/java<1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el5_11
1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el5_11
redhat/java<1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5
1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5
redhat/java<1.6.0-ibm-1:1.6.0.16.25-1jpp.1.el5
1.6.0-ibm-1:1.6.0.16.25-1jpp.1.el5
redhat/java<1.8.0-openjdk-1:1.8.0.91-0.b14.el6_7
1.8.0-openjdk-1:1.8.0.91-0.b14.el6_7
redhat/java<1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el6_7
1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el6_7
redhat/java<1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el6_7
1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el6_7
redhat/java<1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7
1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7
redhat/java<1.6.0-ibm-1:1.6.0.16.25-1jpp.1.el6_7
1.6.0-ibm-1:1.6.0.16.25-1jpp.1.el6_7
redhat/java<1.8.0-ibm-1:1.8.0.3.0-1jpp.1.el6
1.8.0-ibm-1:1.8.0.3.0-1jpp.1.el6
redhat/java<1.8.0-openjdk-1:1.8.0.91-0.b14.el7_2
1.8.0-openjdk-1:1.8.0.91-0.b14.el7_2
redhat/java<1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el7_2
1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el7_2
redhat/java<1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el7_2
1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el7_2
redhat/java<1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el7
1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el7
redhat/java<1.8.0-ibm-1:1.8.0.3.0-1jpp.1.el7
1.8.0-ibm-1:1.8.0.3.0-1jpp.1.el7
redhat/spacewalk-java<0:2.0.2-109.el6
0:2.0.2-109.el6
redhat/java<1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8
1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8
redhat/spacewalk-java<0:2.3.8-146.el6
0:2.3.8-146.el6
debian/openjdk-8
8u442-ga-2
Oracle Java SE and JRockit
Oracle JDK=1.6.0-update113
Oracle JDK=1.7.0-update99
Oracle JDK=1.8.0-update77
Oracle JRE=1.6.0-update113
Oracle JRE=1.7.0-update99
Oracle JRE=1.8.0-update77
Oracle Jrockit=r28.3.9
Oracle Linux=5
Oracle Linux=6
Oracle Linux=7
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
Debian Debian Linux=8.0
NetApp E-series Santricity Management Plug-ins Vmware Vcenter
NetApp E-series Santricity Storage Manager
NetApp E-series Santricity Web Services Web Services Proxy
NetApp OnCommand Balance
NetApp Oncommand Cloud Manager
NetApp OnCommand Insight
NetApp Oncommand Performance Manager
NetApp Oncommand Report
NetApp Oncommand Shift
NetApp Oncommand Unified Manager 7-mode
NetApp Oncommand Unified Manager Clustered Data Ontap
NetApp OnCommand Workflow Automation
NetApp Storagegrid<=9.0.4
NetApp Vasa Provider For Clustered Data Ontap>=7.2
NetApp Virtual Storage Console Vmware Vsphere>=7.2
Apache Cassandra>=2.1.0<2.1.22
Apache Cassandra>=2.2.0<2.2.18
Apache Cassandra>=3.0.0<3.0.22
Apache Cassandra>=3.11.0<3.11.8
Apache Cassandra=4.0.0-beta1
redhat Satellite=5.6
redhat Satellite=5.7
redhat Enterprise Linux Desktop=5.0
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Eus=6.7
redhat Enterprise Linux Eus=7.2
redhat Enterprise Linux Eus=7.3
redhat Enterprise Linux Eus=7.4
redhat Enterprise Linux Eus=7.5
redhat Enterprise Linux Eus=7.6
redhat Enterprise Linux Eus=7.7
redhat Enterprise Linux Server=5.0
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.2
redhat Enterprise Linux Server Aus=7.3
redhat Enterprise Linux Server Aus=7.4
redhat Enterprise Linux Server Aus=7.6
redhat Enterprise Linux Server Aus=7.7
redhat Enterprise Linux Server Eus=6.7
redhat Enterprise Linux Server Eus=7.2
redhat Enterprise Linux Server Tus=7.2
redhat Enterprise Linux Server Tus=7.3
redhat Enterprise Linux Server Tus=7.6
redhat Enterprise Linux Server Tus=7.7
redhat Enterprise Linux Workstation=5.0
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
SUSE Linux Enterprise Module for Legacy=12
SUSE Manager=2.1
SUSE Manager Proxy=2.1
SUSE Openstack Cloud=5
openSUSE Leap=42.1
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
SUSE Linux Enterprise Desktop=12
SUSE Linux Enterprise Desktop=12-sp1
SUSE Linux Enterprise Server=10-sp4
SUSE Linux Enterprise Server=11-sp2
SUSE Linux Enterprise Server=11-sp3
SUSE Linux Enterprise Server=11-sp4
SUSE Linux Enterprise Server=12
SUSE Linux Enterprise Server=12-sp1
SUSE Linux Enterprise Software Development Kit=11-sp4
SUSE Linux Enterprise Software Development Kit=12-sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.101-1jpp.1.el5_11
  2. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.115-1jpp.1.el5_11
  3. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-oracle-1:1.8.0.91-1jpp.1.el6_7
  4. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.101-1jpp.1.el6_7
  5. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.115-1jpp.1.el6_7
  6. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-oracle-1:1.8.0.91-1jpp.1.el7
  7. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-oracle-1:1.7.0.101-1jpp.1.el7
  8. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-sun-1:1.6.0.115-1jpp.1.el7
  9. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el5_11
  10. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el5_11
  11. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5
  12. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.16.25-1jpp.1.el5
  13. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-openjdk-1:1.8.0.91-0.b14.el6_7
  14. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el6_7
  15. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el6_7
  16. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7
  17. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-ibm-1:1.6.0.16.25-1jpp.1.el6_7
  18. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-ibm-1:1.8.0.3.0-1jpp.1.el6
  19. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-openjdk-1:1.8.0.91-0.b14.el7_2
  20. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.0-openjdk-1:1.7.0.101-2.6.6.1.el7_2
  21. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.6.0-openjdk-1:1.6.0.39-1.13.11.0.el7_2
  22. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el7
  23. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.8.0-ibm-1:1.8.0.3.0-1jpp.1.el7
  24. Upgrade

    Upgrade redhat/spacewalk-java to a version that resolves this vulnerability.

    Fixed in 0:2.0.2-109.el6
  25. Upgrade

    Upgrade redhat/java to a version that resolves this vulnerability.

    Fixed in 1.7.1-ibm-1:1.7.1.4.1-1jpp.1.el6_8
  26. Upgrade

    Upgrade redhat/spacewalk-java to a version that resolves this vulnerability.

    Fixed in 0:2.3.8-146.el6
  27. Upgrade

    Upgrade debian/openjdk-8 to a version that resolves this vulnerability.

    Fixed in 8u442-ga-2

Event History

Apr 18, 2016
Data Sourced
via Red Hat·05:55 PM
DescriptionSeverityAffected Software
Apr 19, 2016
CVE Published
12:00 AM
Apr 21, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
May 12, 2023
Known Exploited
via CISA·12:00 AM
Feb 27, 2025
Data Sourced
via Debian·01:49 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2016-3427?

CVE-2016-3427 is classified as a critical vulnerability due to its potential impact on confidentiality, integrity, and availability.

2

How do I fix CVE-2016-3427?

To fix CVE-2016-3427, update to the latest recommended Java version as per the vendor's security advisories.

3

Which versions of Java are affected by CVE-2016-3427?

CVE-2016-3427 affects multiple Java versions including Oracle JDK 6, 7, and 8, along with JRockit.

4

Can CVE-2016-3427 be exploited remotely?

Yes, CVE-2016-3427 can be exploited by remote attackers through vulnerabilities related to Java Management Extensions (JMX).

5

What type of vulnerability is CVE-2016-3427 classified as?

CVE-2016-3427 is classified as a denial of service vulnerability that can lead to various security impacts.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203