CVE-2017-10176: High severity oracle java se 7 vulnerability

Published Jul 18, 2017

Updated

It was discovered that the Elliptic Curve (EC) cryptography implementation in the Security component of OpenJDK did not perform computations for certain points correctly. An attacker able to interact with a Java application using EC cryptography could possibly use this flaw to obtain information about the used key.

Other sources

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

— MITRE

Affected Software

29 affected components

Oracle JDK=1.7.0-update141

Oracle JDK=1.8.0-update131

Oracle JRE=1.7.0-update141

Oracle JRE=1.8.0-update131

Oracle Jrockit=r28.3.14

Debian Debian Linux=9.0

Phoenixcontact Fl Mguard Dm<=1.8.0

NetApp Active Iq Unified Manager Windows>=7.3

NetApp Active Iq Unified Manager Vmware Vsphere>=9.5

NetApp Cloud Backup

NetApp E-Series SANtricity OS Controller>=11.0<=11.70.1

NetApp E-series Santricity Storage Manager

NetApp Element Software

NetApp OnCommand Balance

NetApp OnCommand Insight

NetApp Oncommand Performance Manager Vmware Vsphere

NetApp Oncommand Shift

NetApp Oncommand Unified Manager Vsphere<=7.1

NetApp Oncommand Unified Manager Windows<=7.1

NetApp Oncommand Unified Manager 7-mode

NetApp Plug-in For Symantec Netbackup

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Steelstore Cloud Integrated Storage

NetApp Storage Replication Adapter For Clustered Data Ontap Windows>=7.2

NetApp Vasa Provider For Clustered Data Ontap>=7.2

NetApp Vasa Provider For Clustered Data Ontap=6.0

NetApp Virtual Storage Console Vmware Vsphere>=7.2

NetApp Virtual Storage Console Vmware Vsphere=6.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Jul 18, 2017

Data Sourced

via Red Hat·08:43 PM

DescriptionSeverityAffected Software

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10176?

CVE-2017-10176 is classified as a critical vulnerability due to its ease of exploitation and potential impact on affected systems.

How do I fix CVE-2017-10176?

To remediate CVE-2017-10176, upgrade to the latest versions of Oracle Java SE, Java SE Embedded, or JRockit as advised by Oracle.

Which versions are affected by CVE-2017-10176?

CVE-2017-10176 affects Java SE 7u141, Java SE 8u131, Java SE Embedded 8u131, and JRockit R28.3.14.

Can CVE-2017-10176 be exploited remotely?

Yes, CVE-2017-10176 can be easily exploited by an unauthenticated attacker over the network.

What components of Oracle Java SE does CVE-2017-10176 impact?

CVE-2017-10176 impacts the Security component of Oracle Java SE, Java SE Embedded, and JRockit.