ID CVE-2014-0422
Summary Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JNDI. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to missing package access checks in the Naming / JNDI component, which allows attackers to escape the sandbox.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:jdk:1.5.0:update_55:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.5.0:update_55:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.5.0:update_55:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.5.0:update_55:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.6.0:update_65:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.6.0:update_65:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.6.0:update_65:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.6.0:update_65:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jdk:1.7.0:update_45:*:*:*:*:*:*
    cpe:2.3:a:oracle:jdk:1.7.0:update_45:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.7.0:update_45:*:*:*:*:*:*
    cpe:2.3:a:oracle:jre:1.7.0:update_45:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 05-01-2018 - 02:29)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
assigner via4 cve@mitre.org
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
non_vulnerable_configuration via4
    redhat via4
    advisories
    • rhsa
      id RHSA-2014:0026
    • rhsa
      id RHSA-2014:0027
    • rhsa
      id RHSA-2014:0030
    • rhsa
      id RHSA-2014:0097
    • rhsa
      id RHSA-2014:0134
    • rhsa
      id RHSA-2014:0135
    • rhsa
      id RHSA-2014:0136
    • rhsa
      id RHSA-2014:0414
    rpms
    • java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el6_5
    • java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el6_5
    • java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el6_5
    • java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el6_5
    • java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el6_5
    • java-1.7.0-openjdk-1:1.7.0.51-2.4.4.1.el5_10
    • java-1.7.0-openjdk-demo-1:1.7.0.51-2.4.4.1.el5_10
    • java-1.7.0-openjdk-devel-1:1.7.0.51-2.4.4.1.el5_10
    • java-1.7.0-openjdk-javadoc-1:1.7.0.51-2.4.4.1.el5_10
    • java-1.7.0-openjdk-src-1:1.7.0.51-2.4.4.1.el5_10
    • java-1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el5_10
    • java-1.6.0-openjdk-demo-1:1.6.0.0-3.1.13.1.el5_10
    • java-1.6.0-openjdk-devel-1:1.6.0.0-3.1.13.1.el5_10
    • java-1.6.0-openjdk-javadoc-1:1.6.0.0-3.1.13.1.el5_10
    • java-1.6.0-openjdk-src-1:1.6.0.0-3.1.13.1.el5_10
    • java-1.6.0-openjdk-1:1.6.0.0-3.1.13.1.el6_5
    • java-1.6.0-openjdk-demo-1:1.6.0.0-3.1.13.1.el6_5
    • java-1.6.0-openjdk-devel-1:1.6.0.0-3.1.13.1.el6_5
    • java-1.6.0-openjdk-javadoc-1:1.6.0.0-3.1.13.1.el6_5
    • java-1.6.0-openjdk-src-1:1.6.0.0-3.1.13.1.el6_5
    refmap via4
    bid
    • 64758
    • 64921
    confirm
    hp
    • HPSBUX02972
    • HPSBUX02973
    • SSRT101454
    • SSRT101455
    osvdb 101997
    sectrack 1029608
    secunia
    • 56432
    • 56485
    • 56486
    • 56535
    suse
    • SUSE-SU-2014:0246
    • SUSE-SU-2014:0266
    • SUSE-SU-2014:0451
    • openSUSE-SU-2014:0174
    • openSUSE-SU-2014:0177
    • openSUSE-SU-2014:0180
    ubuntu
    • USN-2089-1
    • USN-2124-1
    vulnerable_product via4
    • cpe:2.3:a:oracle:jdk:1.5.0:update_55:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jre:1.5.0:update_55:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update_65:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jre:1.6.0:update_65:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.7.0:update_45:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jre:1.7.0:update_45:*:*:*:*:*:*
    Last major update 05-01-2018 - 02:29
    Published 15-01-2014 - 16:08
    Back to Top