CVE-2017-3252 Missing authorization in Java JavaSE:6u131;7u121;8u112;JavaSEEmbedded:8u111;JRockit:R28.3.12

Medium 5.8 Published 27 Jan 2017 Updated 9 Oct 2024

A low-privileged attacker can modify or delete critical data in Java SE via JAAS, requiring user interaction and affecting both client and server deployments.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-3252?

CVE-2017-3252 is a medium-severity missing authorization vulnerability in Oracle Jdk, published on 27 Jan 2017. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAAS). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 5.8 (Integrity impacts).

Which versions are affected by CVE-2017-3252?

It affects 3 products.

Products include Oracle Jdk, Oracle Jre, Oracle Jrockit.

How do I fix CVE-2017-3252?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2017-3252 being exploited?

There is no known exploitation of CVE-2017-3252 in the wild and no public exploit code.

All Oracle Jdk vulnerabilities

Sources

Also known as GHSA-942v-9xcr-5cqh, MINI-cv6j-xrq2-hfj9, UBUNTU-CVE-2017-3252.