Bug 1162554 – CVE-2014-3065 IBM JDK: privilege escalation via shared class cache

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1162554 - (CVE-2014-3065) CVE-2014-3065 IBM JDK: privilege escalation via shared class cache

Summary:	CVE-2014-3065 IBM JDK: privilege escalation via shared class cache

Status:	CLOSED ERRATA

Aliases:	CVE-2014-3065

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20141110,repor...
Keywords:	Security

Depends On:
Blocks:	1148726
	Show dependency tree / graph

Reported:	2014-11-11 05:08 EST by Tomas Hoger
Modified:	2015-02-24 08:45 EST (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-11-24 12:15:31 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:1876	normal	SHIPPED_LIVE	Critical: java-1.7.0-ibm security update	2014-11-19 18:32:13 EST
Red Hat Product Errata	RHSA-2014:1877	normal	SHIPPED_LIVE	Critical: java-1.6.0-ibm security update	2014-11-19 18:32:00 EST
Red Hat Product Errata	RHSA-2014:1880	normal	SHIPPED_LIVE	Critical: java-1.7.1-ibm security update	2014-11-20 16:31:54 EST
Red Hat Product Errata	RHSA-2014:1881	normal	SHIPPED_LIVE	Important: java-1.5.0-ibm security update	2014-11-20 16:16:53 EST
Red Hat Product Errata	RHSA-2014:1882	normal	SHIPPED_LIVE	Critical: java-1.7.0-ibm security update	2014-12-02 19:43:08 EST
Red Hat Product Errata	RHSA-2015:0264	normal	SHIPPED_LIVE	Low: Red Hat Satellite IBM Java Runtime security update	2015-02-24 13:44:15 EST

Groups: None (edit)

Description Tomas Hoger 2014-11-11 05:08:22 EST

IBM JDK updates 5.0 SR16-FP8, 6 SR16-FP2, 6R1 SR8-FP2, 7 SR8, and 7R1 SR2 fix a security issue described in the IBM security bulletin as:

  IBM Java SDK contains a vulnerability in which the default configuration for
  the shared classes feature potentially allows arbitrary code to be injected
  into the shared classes cache, which may subsequently be executed by other
  local users.

This issue may possibly allow local users to run arbitrary code with the privileges of other users that use IBM JDK.

References:
http://www-01.ibm.com/support/docview.wss?uid=swg21688283
http://xforce.iss.net/xforce/xfdb/93629
http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2014

Additional references that describe the shared class cache feature:
http://www.ibm.com/developerworks/library/j-ibmjava4/
http://www.ibm.com/developerworks/library/j-sharedclasses/
http://www-01.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.lnx.71.doc/diag/understanding/shared_classes.html
http://www-01.ibm.com/support/knowledgecenter/SSYKE2_7.0.0/com.ibm.java.lnx.71.doc/diag/appendixes/cmdline/Xshareclasses.html

Comment 1 errata-xmlrpc 2014-11-19 13:33:14 EST

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1877 https://rhn.redhat.com/errata/RHSA-2014-1877.html

Comment 2 errata-xmlrpc 2014-11-19 13:34:07 EST

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2014:1876 https://rhn.redhat.com/errata/RHSA-2014-1876.html

Comment 3 errata-xmlrpc 2014-11-20 11:19:30 EST

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1882 https://rhn.redhat.com/errata/RHSA-2014-1882.html

Comment 4 errata-xmlrpc 2014-11-20 11:34:33 EST

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2014:1880 https://rhn.redhat.com/errata/RHSA-2014-1880.html

Comment 5 errata-xmlrpc 2014-11-20 11:53:15 EST

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1881 https://rhn.redhat.com/errata/RHSA-2014-1881.html

Comment 6 errata-xmlrpc 2015-02-24 08:45:50 EST

This issue has been addressed in the following products:

  Red Hat Satellite Server v 5.6

Via RHSA-2015:0264 https://rhn.redhat.com/errata/RHSA-2015-0264.html

Note You need to log in before you can comment on or make changes to this bug.