CVE-2018-12539 Missing authorization in Eclipse OpenJ9

What is CVE-2018-12539?

CVE-2018-12539 is a high-severity missing authorization vulnerability in Oracle Enterprise Manager Base Platform, published on 14 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no.

Weakness: CWE-502, CWE-419

Which versions are affected by CVE-2018-12539?

It affects 2 products.

Products include Eclipse Openj9, Oracle Enterprise Manager Base Platform.

How do I fix CVE-2018-12539?

Change a configuration setting.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-12539 being exploited?

There is no known exploitation of CVE-2018-12539 in the wild and no public exploit code.

Other vulnerabilities in Oracle Enterprise Manager Base Platform

• CVE-2021-41035 Security feature bypass in Eclipse OMR Critical 9.8
• CVE-2020-27221 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2019-11772 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12547 Memory corruption in Eclipse OpenJ9 Critical 9.8
• CVE-2018-12549 Null dereference in Eclipse OpenJ9 Critical 9.8

All Oracle Enterprise Manager Base Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8xmg-5xjr-x475.