CVE-2017-3544: Low severity Google Android vulnerability
It was discovered that the SMTP client implementation in the Networking component of OpenJDK failed to correctly handle sender and recipient addresses containing newline characters. A remote attacker could possibly use this flaw to manipulate an SMTP connection opened by a Java application if it could make it send an email to or from a specially crafted address.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Java SE (Networking subcomponent)to a version that resolves this vulnerability.Fixed in 6u141 - Upgrade
Upgrade
Oracle Java SE (Networking subcomponent)to a version that resolves this vulnerability.Fixed in 7u131 - Upgrade
Upgrade
Oracle Java SE (Networking subcomponent)to a version that resolves this vulnerability.Fixed in 8u121 - Upgrade
Upgrade
Oracle Java SE Embedded (Networking subcomponent)to a version that resolves this vulnerability.Fixed in 8u121 - Upgrade
Upgrade
JRockit (Networking subcomponent)to a version that resolves this vulnerability.Fixed in R28.3.13
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3544?
The severity of CVE-2017-3544 is classified as difficult to exploit, allowing unauthenticated attackers to potentially execute arbitrary code.
How do I fix CVE-2017-3544?
To fix CVE-2017-3544, upgrade your Oracle Java SE or JRockit to the latest patched version as recommended by Oracle.
Which versions of Java are affected by CVE-2017-3544?
Affected versions include Oracle Java SE 6u141, 7u131, 8u121 and JRockit R28.3.13.
Does CVE-2017-3544 affect Google Android?
Yes, CVE-2017-3544 affects specific versions of Google Android that utilize vulnerable Java components.
Is CVE-2017-3544 related to networking vulnerabilities in Java?
Yes, CVE-2017-3544 is a vulnerability in the Networking component of Java SE, affecting secure communication.