A vulnerability was found in the Java Certificate Management System (CMS) keystore provider that could potentially allow an attacker to recover the private key from CMS keystores via a brute-force attack.

External References:

http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateJuly2014 http://www-01.ibm.com/support/docview.wss?uid=swg21680334 http://xforce.iss.net/xforce/xfdb/93756

IBM JDK updates 5.0 SR16-FP8, 6 SR16-FP2, 6R1 SR8-FP2, 7 SR8, and 7R1 SR2 fix a security issue described in the IBM security bulletin as:

IBM Java SDK contains a vulnerability in which the default configuration for the shared classes feature potentially allows arbitrary code to be injected into the shared classes cache, which may subsequently be executed by other local users.

This issue may possibly allow local users to run arbitrary code with the privileges of other users that use IBM JDK.

References: http://www-01.ibm.com/support/docview.wss?uid=swg21688283 http://xforce.iss.net/xforce/xfdb/93629 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateNovember2014

Additional references that describe the shared class cache feature: http://www.ibm.com/developerworks/library/j-ibmjava4/ http://www.ibm.com/developerworks/library/j-sharedclasses/ http://www-01.ibm.com/support/knowledgecenter/SSYKE27.0.0/com.ibm.java.lnx.71.doc/diag/understanding/sharedclasses.html http://www-01.ibm.com/support/knowledgecenter/SSYKE27.0.0/com.ibm.java.lnx.71.doc/diag/appendixes/cmdline/Xshareclasses.html