CVE-2017-10285
First published: Fri Oct 13 2017(Updated: )
A flaw was found in the privileged code used to handle unreferenced objects in the Target class in the RMI component of OpenJDK. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openjdk-8 | 8u382-ga-2 | |
| Oracle Java SE 7 | =1.6.0-update161 | |
| Oracle Java SE 7 | =1.7.0-update151 | |
| Oracle Java SE 7 | =1.8.0-update144 | |
| Oracle Java SE 7 | =1.9.0 | |
| Oracle JRE | =1.6.0-update161 | |
| Oracle JRE | =1.7.0-update151 | |
| Oracle JRE | =1.8.0-update144 | |
| Oracle JRE | =1.9.0 | |
| Debian Linux | =7.0 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Red Hat Satellite | =5.8 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server EUS | =7.4 | |
| Red Hat Enterprise Linux Server EUS | =7.5 | |
| Red Hat Enterprise Linux Server EUS | =7.6 | |
| Red Hat Enterprise Linux Server EUS | =7.7 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.7 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.7 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| NetApp Active IQ Unified Manager | >=7.3 | |
| NetApp Active IQ Unified Manager for VMware vSphere | >=9.5 | |
| NetApp Cloud Backup | ||
| NetApp E-Series SANtricity Management Plug-ins for VMware vCenter | ||
| NetApp E-Series SANtricity OS Controller | >=11.0<=11.70.1 | |
| NetApp SANtricity Storage Manager | ||
| NetApp E-Series SANtricity Web Services | ||
| NetApp Management Services for Element Software | ||
| NetApp OnCommand Balance | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Performance Manager | ||
| NetApp OnCommand Shift | ||
| NetApp OnCommand Unified Manager for vSphere | <=7.1 | |
| NetApp OnCommand Unified Manager for Windows | <=7.1 | |
| NetApp OnCommand Unified Manager for 7-Mode | ||
| NetApp OnCommand Workflow Automation | ||
| NetApp Plug-in for Symantec NetBackup | ||
| NetApp SnapManager for Oracle | ||
| NetApp SnapManager for SAP | ||
| NetApp SteelStore Cloud Integrated Storage | ||
| NetApp Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere | >=7.2 | |
| NetApp Storage Replication Adapter for Clustered Data ONTAP | >=7.2 | |
| NetApp VASA Provider | >=7.2 | |
| NetApp VASA Provider | =6.0. | |
| NetApp Virtual Storage Console for VMware vSphere | >=7.2 | |
| NetApp Virtual Storage Console for VMware vSphere | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/101319
- http://www.securitytracker.com/id/1039596
- https://access.redhat.com/errata/RHSA-2017:2998
- https://access.redhat.com/errata/RHSA-2017:2999
- https://access.redhat.com/errata/RHSA-2017:3046
- https://access.redhat.com/errata/RHSA-2017:3047
- https://access.redhat.com/errata/RHSA-2017:3264
- https://access.redhat.com/errata/RHSA-2017:3267
- https://access.redhat.com/errata/RHSA-2017:3268
- https://access.redhat.com/errata/RHSA-2017:3392
- https://access.redhat.com/errata/RHSA-2017:3453
- https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html
- https://security.gentoo.org/glsa/201710-31
- https://security.gentoo.org/glsa/201711-14
- https://security.netapp.com/advisory/ntap-20171019-0001/
- https://www.debian.org/security/2017/dsa-4015
- https://www.debian.org/security/2017/dsa-4048
- https://www.synology.com/support/security/Synology_SA_17_66_OpenJDK
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/0c7e380005ee
- https://bugzilla.redhat.com/show_bug.cgi?id=1501868
- https://security-tracker.debian.org/tracker/CVE-2017-10285
Frequently Asked Questions
What is the severity of CVE-2017-10285?
CVE-2017-10285 is considered to have high severity due to its potential to allow untrusted Java applications to bypass sandbox restrictions.
How do I fix CVE-2017-10285?
To fix CVE-2017-10285, you should update your Java SE or Java Runtime Environment to the latest version that addresses this vulnerability.
Which versions are affected by CVE-2017-10285?
CVE-2017-10285 affects multiple versions of Oracle JDK and JRE, specifically 1.6.0-update161, 1.7.0-update151, and 1.8.0-update144, among others.
What could happen if CVE-2017-10285 is exploited?
If exploited, CVE-2017-10285 could allow an attacker to execute untrusted code with elevated privileges, compromising the security of the host system.
Is there a workaround for CVE-2017-10285?
While updating is the most effective solution for CVE-2017-10285, restricting the execution of untrusted Java applications may serve as a temporary workaround.
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10285
- agent/severity
- agent/references
- agent/author
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/oracle
- canonical/oracle java se 7
- version/oracle java se 7/1.6.0-update161
- version/oracle java se 7/1.7.0-update151
- version/oracle java se 7/1.8.0-update144
- version/oracle java se 7/1.9.0
- canonical/oracle jre
- version/oracle jre/1.6.0-update161
- version/oracle jre/1.7.0-update151
- version/oracle jre/1.8.0-update144
- version/oracle jre/1.9.0
- vendor/debian
- canonical/debian linux
- version/debian linux/7.0
- version/debian linux/8.0
- version/debian linux/9.0
- vendor/redhat
- canonical/red hat satellite
- version/red hat satellite/5.8
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server eus
- version/red hat enterprise linux server eus/7.4
- version/red hat enterprise linux server eus/7.5
- version/red hat enterprise linux server eus/7.6
- version/red hat enterprise linux server eus/7.7
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.4
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.7
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- vendor/netapp
- canonical/netapp active iq unified manager
- version/netapp active iq unified manager/7.3
- canonical/netapp active iq unified manager for vmware vsphere
- version/netapp active iq unified manager for vmware vsphere/9.5
- canonical/netapp cloud backup
- canonical/netapp e-series santricity management plug-ins for vmware vcenter
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0
- version/netapp e-series santricity os controller/11.70.1
- canonical/netapp santricity storage manager
- canonical/netapp e-series santricity web services
- canonical/netapp management services for element software
- canonical/netapp oncommand balance
- canonical/netapp oncommand insight
- canonical/netapp oncommand performance manager
- canonical/netapp oncommand shift
- canonical/netapp oncommand unified manager for vsphere
- version/netapp oncommand unified manager for vsphere/7.1
- canonical/netapp oncommand unified manager for windows
- version/netapp oncommand unified manager for windows/7.1
- canonical/netapp oncommand unified manager for 7-mode
- canonical/netapp oncommand workflow automation
- canonical/netapp plug-in for symantec netbackup
- canonical/netapp snapmanager for oracle
- canonical/netapp snapmanager for sap
- canonical/netapp steelstore cloud integrated storage
- canonical/netapp storage replication adapter for clustered data ontap for vmware vsphere
- version/netapp storage replication adapter for clustered data ontap for vmware vsphere/7.2
- canonical/netapp storage replication adapter for clustered data ontap
- version/netapp storage replication adapter for clustered data ontap/7.2
- canonical/netapp vasa provider
- version/netapp vasa provider/7.2
- version/netapp vasa provider/6.0.
- canonical/netapp virtual storage console for vmware vsphere
- version/netapp virtual storage console for vmware vsphere/7.2
- version/netapp virtual storage console for vmware vsphere/6.0