Bug 1183039 (CVE-2015-0400)

Summary: CVE-2015-0400 OpenJDK: NTLM authentication data disclosure via redirect to proxy (Libraries, 8048035)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-01-16 14:27:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1179762    

Description Tomas Hoger 2015-01-16 14:26:29 UTC
A flaw was found in the way the HTTPUrlConnection class in the Libraries component in OpenJDK handled HTTP 305 "Use Proxy" server responses when using NTLM transparent proxy authentication.  A malicious HTTP server could possibly cause an application using HTTPUrlConnection to disclose NTLM authentication data to an attacker-chosen proxy server.

Note that the NTLM transparent authentication is only available in OpenJDK versions on the Microsoft Windows platform.  Therefore, the OpenJDK packages in Red Hat Enterprise Linux and Fedora were not affected by this issue.

Comment 1 Tomas Hoger 2015-01-16 14:27:49 UTC
Statement:

Not vulnerable. This issue did not affect the versions of OpenJDK and Oracle JDK as shipped with Red Hat Enterprise Linux.

Comment 2 Tomas Hoger 2015-01-20 22:23:17 UTC
Public now via Oracle Critical Patch Update - January 2015.  Fixed in Oracle Java SE 6u91, 7u75, and 8u31.

External References:

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#AppendixJAVA