REDHAT-BUG-1273430: Medium severity openjdk 8 vulnerability

Published Oct 20, 2015

Updated

It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Oct 20, 2015

Data Sourced

via Red Hat·12:40 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems running OpenJDK with the Java Security Manager enabled are exposed when they execute an untrusted Java application or applet. The flaw concerns access to Kerberos configuration information on the host.

What would an attacker need to exploit it?

An attacker would need to run an untrusted Java application or applet in the affected Security Manager sandbox. Exploitation allows the application to obtain certain Kerberos realm information through error exceptions.

What is the impact of successful exploitation?

Successful exploitation bypasses certain Java sandbox restrictions and discloses limited information about the host's Kerberos configuration. The provided information does not indicate that the attacker gains code execution or modification capabilities.

REDHAT-BUG-1273430: Medium severity openjdk 8 vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What would an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What would an attacker need to exploit it?

What is the impact of successful exploitation?