CVE-2018-12539: High severity eclipse openj9 vulnerability

Published Aug 14, 2018

Updated

IBM JDK 8 SR5 FP20 (8.0.5.20), 7 R1 SR4 FP30 (7.1.4.30), 7 SR10 FP30 (7.0.10.30), and 6 SR16 FP70 (6.0.16.70) fix a flaw described by upstream as:

Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system, caused by the failure to restrict the use of Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations to only the process owner. An attacker could exploit this vulnerability to execute untrusted native code and gain elevated privileges on the system.

References:

https://www-01.ibm.com/support/docview.wss?uid=ibm10719653 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateAugust2018

More details can be found in the Eclipse bugzilla:

https://bugs.eclipse.org/bugs/showbug.cgi?id=534589#c3

Other sources

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no.

— MITRE

Affected Software

3 affected components

Eclipse Openj9=0.8

Oracle Enterprise Manager Base Platform=13.2.0.0.0

Oracle Enterprise Manager Base Platform=13.3.0.0.0

Remediation

Patch Available

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Event History

Aug 14, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Aug 17, 2018

Data Sourced

via Red Hat·02:21 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is CVE-2018-12539?

CVE-2018-12539 is a vulnerability in Eclipse OpenJ9 version 0.8 that allows users other than the process owner to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and execute untrusted native code.

How severe is CVE-2018-12539?

CVE-2018-12539 has a severity rating of 7 (high).

How does CVE-2018-12539 affect Eclipse OpenJ9?

CVE-2018-12539 affects Eclipse OpenJ9 version 0.8, allowing unauthorized users to use Java Attach API and execute untrusted native code.

Does CVE-2018-12539 affect Oracle Enterprise Manager Base Platform?

Yes, CVE-2018-12539 also affects Oracle Enterprise Manager Base Platform versions 13.2.0.0.0 and 13.3.0.0.0.

How can I fix CVE-2018-12539?

To fix CVE-2018-12539, update to a version of Eclipse OpenJ9 or IBM JVM that is not affected by the vulnerability.