CVE-2017-10102: Critical severity oracle java se 7 vulnerability
It was discovered that the DCG (Distributed Garbage Collector) implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application.
Other sources
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10102?
CVE-2017-10102 has been classified as a difficult-to-exploit vulnerability that allows unauthenticated network access.
How do I fix CVE-2017-10102?
To fix CVE-2017-10102, update your Oracle Java SE or JRE to a version that is not affected, specifically above the vulnerable versions.
What versions of affected software are impacted by CVE-2017-10102?
Affected versions for CVE-2017-10102 include Java SE 6u151, 7u141, and 8u131 as well as Java SE Embedded 8u131.
Who is at risk from CVE-2017-10102?
Any systems running the vulnerable versions of Oracle Java SE or JRE with network access are at risk from CVE-2017-10102.
Is it necessary to implement additional measures for CVE-2017-10102 after patching?
Yes, it is advisable to implement additional security measures and regularly monitor the environment even after patching against CVE-2017-10102.