Bug 706153 (CVE-2011-0867)
| Summary: | CVE-2011-0867 OpenJDK: NetworkInterface information leak (Networking, 7013969) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marc Schoenefeld <mschoene> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahughes, aph, dbhole, djorm, jvanek, mjc, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-05-06 07:29:12 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 668488, 676275, 709375, 709376, 711408, 711409, 711410, 720963, 720964, 720965, 723824, 723825, 723826, 729588, 729589, 729907, 729908, 729909 | ||
| Bug Blocks: | |||
|
Description
Marc Schoenefeld
2011-05-19 16:14:03 UTC
Reproducer can be found at http://slightlyrandombrokenthoughts.blogspot.com/2011/02/trusted-method-chaining-for-network.html An information leak was found in NetworkInterface. Unprivileged code could obtain certain network interface configuration information via trusted method chaining. Details can be found in the blog post linked in comment #2. Public now via Oracle CPU June 2011: http://www.oracle.com/technetwork/topics/security/javacpujune2011-313339.html Also fixed in IcedTea6 versions 1.8.8, 1.9.8 and 1.10.2: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2011-June/014607.html Patch: http://icedtea.classpath.org/hg/release/icedtea6-1.9/file/8d393fbff5d3/patches/security/20110607/7013969.patch This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0856 https://rhn.redhat.com/errata/RHSA-2011-0856.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0857 https://rhn.redhat.com/errata/RHSA-2011-0857.html This issue has been addressed in following products: Extras for RHEL 4 Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2011:0860 https://rhn.redhat.com/errata/RHSA-2011-0860.html This issue has been addressed in following products: Extras for RHEL 4 Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2011:0938 https://rhn.redhat.com/errata/RHSA-2011-0938.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 6 Extras for RHEL 4 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2011:1087 https://rhn.redhat.com/errata/RHSA-2011-1087.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Extras for RHEL 4 Via RHSA-2011:1159 https://rhn.redhat.com/errata/RHSA-2011-1159.html This issue has been addressed in following products: RHEL 4 for SAP RHEL 5 for SAP RHEL 6 for SAP Via RHSA-2011:1265 https://rhn.redhat.com/errata/RHSA-2011-1265.html This issue has been addressed in following products: Red Hat Network Satellite Server v 5.4 Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html |