CVE-2018-1656 Path traversal in SDK, Java Technology Edition
Attackers can exploit path traversal in IBM Java DTFJ to read or modify files during dump extraction, affecting IBM Java SDK users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1656?
CVE-2018-1656 is a high-severity path traversal vulnerability in Oracle Enterprise Manager Base Platform, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
Weakness: CWE-22
Which versions are affected by CVE-2018-1656?
It affects 6 products.
Products include Ibm Sdk, Oracle Enterprise Manager Base Platform, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Redhat Satellite.
How do I fix CVE-2018-1656?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1656 being exploited?
There is no known exploitation of CVE-2018-1656 in the wild and no public exploit code.
Other vulnerabilities in Oracle Enterprise Manager Base Platform
Sources
Also known as GHSA-x34g-2xv6-mxf5.