CVE-2017-3533: Low severity Oracle JDK vulnerability
It was discovered that the FTP client implementation in the Networking component of OpenJDK failed to correctly handle user inputs (e.g. usernames and passwords) containing newline characters. A remote attacker could possibly use this flaw to manipulate an FTP connection opened by a Java application if it could make it access a specially crafted FTP URL.
Blog posts were published that describe how to use this flaw to open ports on firewalls using active FTP connections:
http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html
and sending mails during XML parsing when use of XML external entities is allowed:
https://shiftordie.de/blog/2017/02/18/smtp-over-xxe/
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via FTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Java SEto a version that resolves this vulnerability.Fixed in 6u141 - Upgrade
Upgrade
Java SEto a version that resolves this vulnerability.Fixed in 7u131 - Upgrade
Upgrade
Java SEto a version that resolves this vulnerability.Fixed in 8u121 - Upgrade
Upgrade
Java SE Embeddedto a version that resolves this vulnerability.Fixed in 8u121 - Upgrade
Upgrade
JRockitto a version that resolves this vulnerability.Fixed in R28.3.13
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3533?
CVE-2017-3533 is classified as a difficult to exploit vulnerability that could allow an unauthenticated attacker to compromise the affected system.
How do I fix CVE-2017-3533?
To fix CVE-2017-3533, upgrading to a supported version of Oracle Java SE or removing the vulnerable version is recommended.
Which versions of Java are affected by CVE-2017-3533?
CVE-2017-3533 affects Java SE versions 6u141, 7u131, and 8u121, as well as Java SE Embedded version 8u121 and JRockit version R28.3.13.
Is CVE-2017-3533 related to networking vulnerabilities?
Yes, CVE-2017-3533 is a vulnerability in the Networking component of Oracle Java SE.
Can CVE-2017-3533 be exploited remotely?
CVE-2017-3533 is difficult to exploit, but it does pose a potential risk of remote exploitation by an unauthenticated attacker.