Bug 907455 (CVE-2013-0427)

Summary:	CVE-2013-0427 OpenJDK: invalid threads subject to interrupts (Libraries, 6776941)
Product:	[Other] Security Response	Reporter:	Stefan Cornelius <scorneli>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dbhole, jvanek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	icedtea6 1.11.6, icedtea6 1.12.1, icedtea7 2.1.5, icedtea7 2.2.5, icedtea7 2.3.6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-03-12 09:21:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	906729

Description Stefan Cornelius 2013-02-04 13:06:38 UTC

It was discovered that invalid threads provided by a thread factory could
be subject to an interrupt on shutdown. A malicious Java application or
applet could possibly use this flaw to interrupt threads intended to be
uninterruptable.

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

Comment 1 Tomas Hoger 2013-02-04 16:43:50 UTC

Upstream commit, as included in IcedTea7 repositories:

http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/87d135824bdf

Comment 2 errata-xmlrpc 2013-02-04 23:56:12 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2013:0237 https://rhn.redhat.com/errata/RHSA-2013-0237.html

Comment 3 errata-xmlrpc 2013-02-04 23:57:31 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2013:0236 https://rhn.redhat.com/errata/RHSA-2013-0236.html

Comment 4 errata-xmlrpc 2013-02-08 19:16:39 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2013:0246 https://rhn.redhat.com/errata/RHSA-2013-0246.html

Comment 5 errata-xmlrpc 2013-02-08 19:27:30 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2013:0247 https://rhn.redhat.com/errata/RHSA-2013-0247.html

Comment 6 errata-xmlrpc 2013-02-08 19:37:34 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0245 https://rhn.redhat.com/errata/RHSA-2013-0245.html

Comment 7 Tomas Hoger 2013-02-14 10:14:06 UTC

Fixed in upstream IcedTea versions IcedTea6 1.11.6, and 1.12.1, and IcedTea7 2.1.5, 2.2.5, and 2.3.6:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021708.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021728.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021905.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-February/021876.html

Note that version 2.3.5 was tagged in upstream mercurial including the security fixes, but was not released.  Only 2.3.6 was released, correcting problem introduced by security patches as included in 2.3.5.

Comment 8 errata-xmlrpc 2013-03-11 18:49:37 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2013:0624 https://rhn.redhat.com/errata/RHSA-2013-0624.html

Comment 9 errata-xmlrpc 2013-03-11 19:00:32 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2013:0626 https://rhn.redhat.com/errata/RHSA-2013-0626.html

Comment 10 errata-xmlrpc 2013-03-11 19:02:02 UTC

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2013:0625 https://rhn.redhat.com/errata/RHSA-2013-0625.html

Comment 11 errata-xmlrpc 2013-10-23 16:38:46 UTC

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html

Comment 12 errata-xmlrpc 2013-10-23 16:50:11 UTC

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html