First published: Mon Apr 16 2018(Updated: )
It was discovered that the RMI component of OpenJDK enabled HTTP transport for RMI servers by default. This could possibly expose RMI services to attackers who can not connect to them directly by attacking web browsers of users able to directly connect to the services. The fix for this issue disables the use of RMI HTTP transport by default. System properly java.rmi.server.disableIncomingHttp (with the default value of "true") can be used to enable HTTP transport.
Credit: secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/openjdk-8 | 8u432-b06-2 | |
Oracle Java SE 7 | =1.6.0-update181 | |
Oracle Java SE 7 | =1.7.0-update171 | |
Oracle Java SE 7 | =1.8.0-update162 | |
Oracle JRE | =1.6.0-update181 | |
Oracle JRE | =1.7.0-update171 | |
Oracle JRE | =1.8.0-update162 | |
Oracle Java SE | =r28.3.17 | |
Red Hat Satellite | =5.6 | |
Red Hat Satellite | =5.7 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.5 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =17.10 | |
Schneider Electric EcoStruxure Data Center Expert | ||
Schneider Electric EcoStruxure Data Center Expert | <7.6.0 | |
HP P9000 Command View Advanced Edition Software |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2018-2800.
The vulnerability affects Java SE (versions 6u181, 7u171, and 8u162) and JRockit (version R28.3.17).
The severity of CVE-2018-2800 is medium with a CVSS score of 4.2.
To fix CVE-2018-2800, update Java SE to version 6u181, 7u171, or 8u162, and update JRockit to version R28.3.17.
More information about CVE-2018-2800 can be found at the following references: [link1](http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html), [link2](http://www.securityfocus.com/bid/103849), [link3](http://www.securitytracker.com/id/1040697).