Bug 865346 (CVE-2012-3216)

Summary: CVE-2012-3216 OpenJDK: java.io.FilePermission information leak (Libraries, 6631398)
Product: [Other] Security Response Reporter: Stefan Cornelius <scorneli>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ahughes, aph, dbhole, jvanek, neugens, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: icedtea6 1.10.10, icedtea6 1.11.5, icedtea7 2.1.3, icedtea7 2.2.3, icedtea7 2.3.3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-11-22 19:44:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 862579    

Description Stefan Cornelius 2012-10-11 09:31:39 UTC
Sami Koivu's blog post from 2009 describes an information leak in the java.io.FilePermission class.  Patch name specified as a constructor argument is transformed to a canonical path internally.  Hash code of this canonical path is exposed via FilePermission's hashCode() method.  Sandboxed code could possibly use this flaw to get information about file system paths (such as JVM current directory - user.dir, or user's home directory).  Blog post also describes that this issued can be used to check existence of files or directories on system with case insensitive file systems (such as Windows).

http://slightlyrandombrokenthoughts.blogspot.com/2009/12/filepermission-class-leaks-sensitive.html

Comment 3 errata-xmlrpc 2012-10-17 16:10:36 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1386 https://rhn.redhat.com/errata/RHSA-2012-1386.html

Comment 4 errata-xmlrpc 2012-10-17 16:10:49 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1385 https://rhn.redhat.com/errata/RHSA-2012-1385.html

Comment 5 errata-xmlrpc 2012-10-17 16:11:36 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1384 https://rhn.redhat.com/errata/RHSA-2012-1384.html

Comment 7 errata-xmlrpc 2012-10-18 16:45:46 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1391 https://rhn.redhat.com/errata/RHSA-2012-1391.html

Comment 8 errata-xmlrpc 2012-10-18 16:56:41 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1392 https://rhn.redhat.com/errata/RHSA-2012-1392.html

Comment 9 errata-xmlrpc 2012-11-15 21:08:25 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1467 https://rhn.redhat.com/errata/RHSA-2012-1467.html

Comment 10 errata-xmlrpc 2012-11-15 21:10:05 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1465 https://rhn.redhat.com/errata/RHSA-2012-1465.html

Comment 11 errata-xmlrpc 2012-11-15 21:17:31 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1466 https://rhn.redhat.com/errata/RHSA-2012-1466.html

Comment 12 errata-xmlrpc 2012-11-22 18:15:23 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1485 https://rhn.redhat.com/errata/RHSA-2012-1485.html

Comment 13 errata-xmlrpc 2013-10-23 16:32:29 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html

Comment 14 errata-xmlrpc 2013-10-23 17:06:27 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html