CVE-2017-3252: Medium severity Oracle JDK vulnerability
It was discovered that the LdapLoginModule class in the Java Authentication and Authorization Service (JAAS) component of OpenJDK did not use a correct way to extract user DN from a result of the LDAP query used to locate user in an LDAP database. A specially crafted user LDAP entry could cause the application to use incorrect DN.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAAS). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.8 (Integrity impacts).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u442-ga-2 - Upgrade
Upgrade
Oracle Java SE (subcomponent: JAAS)to a version that resolves this vulnerability.Fixed in 6u131 - Upgrade
Upgrade
Oracle Java SE (subcomponent: JAAS)to a version that resolves this vulnerability.Fixed in 7u121 - Upgrade
Upgrade
Oracle Java SE (subcomponent: JAAS)to a version that resolves this vulnerability.Fixed in 8u112 - Upgrade
Upgrade
Oracle Java SE (subcomponent: JAAS)to a version that resolves this vulnerability.Fixed in 8u111 - Upgrade
Upgrade
Oracle Java SE (subcomponent: JAAS)to a version that resolves this vulnerability.Fixed in R28.3.12
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3252?
CVE-2017-3252 is rated as a high severity vulnerability due to its potential impact on user authentication.
How do I fix CVE-2017-3252?
To fix CVE-2017-3252, update your Java environment to the latest version as provided by Oracle.
Which software versions are affected by CVE-2017-3252?
CVE-2017-3252 affects specific versions of Oracle JDK and JRE including 1.6-update_131, 1.7-update_121, and 1.8-update_111 and 1.8-update_112.
What is the attack vector for CVE-2017-3252?
CVE-2017-3252 can be exploited through specially crafted LDAP entries that allow unauthorized access during authentication.
Is CVE-2017-3252 remotely exploitable?
Yes, CVE-2017-3252 is remotely exploitable if the LDAP authentication is utilized in the affected environments.