REDHAT-BUG-1273496: Medium severity OpenJDK RMI component vulnerability

Published Oct 20, 2015

Updated

It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox.

Affected Software

1 affected component

OpenJDK RMI component

Event History

Oct 20, 2015

Data Sourced

via Red Hat·02:50 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1273496?

The vulnerability REDHAT-BUG-1273496 is rated as critical due to its potential to allow untrusted applications to bypass Java sandbox restrictions.

How do I fix REDHAT-BUG-1273496?

To fix REDHAT-BUG-1273496, upgrade to the patched version of the OpenJDK RMI component as recommended by your vendor.

What systems are affected by REDHAT-BUG-1273496?

The REDHAT-BUG-1273496 affects systems running the OpenJDK RMI component that do not have the necessary patches applied.

What is the impact of REDHAT-BUG-1273496?

The impact of REDHAT-BUG-1273496 allows attackers to execute arbitrary code on affected systems if exploited.

Is there a workaround for REDHAT-BUG-1273496?

While the best mitigation for REDHAT-BUG-1273496 is to apply the security update, temporarily limiting the execution of untrusted Java applications can act as a workaround.