Bug 1357516 (CVE-2016-3485)

Summary: CVE-2016-3485 OpenJDK: weak authentication secret in Pipe implementation on Windows (Networking, 8145446)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-18 12:17:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1350028    

Description Tomas Hoger 2016-07-18 12:13:40 UTC 
It was discovered that the Pipe (java.nio.channels.Pipe) implementation in the Networking component of OpenJDK that is used on the Microsoft Windows platformed used an insecure method to authenticate process which can use the Pipe. A local attacker could possibly use the flaw to connect to the Pipes created by other Java programs running on the system.

This issue did not affect OpenJDK versions running on Linux, where Pipe is implemented using the pipe() system call.  On Windows, Pipe support is implemented via a network socket listening on a loopback address (127.0.0.1) and using authentication with a secret value to prevent unauthorized access to the Pipe.  A weak method to generate the secret could possibly allow bypass of the authentication mechanism.
Comment 1 Tomas Hoger 2016-07-20 07:46:34 UTC 
Public now via Oracle CPU July 2016, fixed in Oracle JDK 8u101, 7u111, and 6u121.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA
Comment 2 Tomas Hoger 2016-07-20 09:40:01 UTC 
OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/a3a382d63d5b