CVE-2017-3241: Input Validation
It was discovered that the RMI registry and DCG (Distributed Garbage Collector) implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u442-ga-2
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3241?
CVE-2017-3241 has been classified with a high severity level due to the potential for remote code execution.
How do I fix CVE-2017-3241?
To fix CVE-2017-3241, update your OpenJDK or Oracle JDK to a version that includes the security patch, such as Oracle JDK 8u442 or later.
Which software versions are affected by CVE-2017-3241?
CVE-2017-3241 affects specific versions of Oracle JDK and JRE, including 1.6-update_131, 1.7-update_121, and 1.8-update_111 and 1.8-update_112.
Can CVE-2017-3241 lead to unauthorized access?
Yes, CVE-2017-3241 can potentially allow a remote attacker to execute arbitrary code, leading to unauthorized access.
Is there a workaround for CVE-2017-3241?
A temporary workaround for CVE-2017-3241 is to disable RMI or restrict access to the RMI registry until you can apply a patch.