Bug 865346 (CVE-2012-3216) - CVE-2012-3216 OpenJDK: java.io.FilePermission information leak (Libraries, 6631398)
Summary: CVE-2012-3216 OpenJDK: java.io.FilePermission information leak (Libraries, 66...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-3216
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 862579
TreeView+ depends on / blocked
 
Reported: 2012-10-11 09:31 UTC by Stefan Cornelius
Modified: 2019-09-29 12:56 UTC (History)
6 users (show)

Fixed In Version: icedtea6 1.10.10, icedtea6 1.11.5, icedtea7 2.1.3, icedtea7 2.2.3, icedtea7 2.3.3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-22 19:44:39 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1384 normal SHIPPED_LIVE Critical: java-1.6.0-openjdk security update 2012-10-17 20:07:50 UTC
Red Hat Product Errata RHSA-2012:1385 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security update 2012-10-17 20:06:54 UTC
Red Hat Product Errata RHSA-2012:1386 normal SHIPPED_LIVE Important: java-1.7.0-openjdk security update 2012-11-14 00:28:44 UTC
Red Hat Product Errata RHSA-2012:1391 normal SHIPPED_LIVE Critical: java-1.7.0-oracle security update 2012-10-18 20:44:09 UTC
Red Hat Product Errata RHSA-2012:1392 normal SHIPPED_LIVE Critical: java-1.6.0-sun security update 2012-10-18 20:54:24 UTC
Red Hat Product Errata RHSA-2012:1465 normal SHIPPED_LIVE Critical: java-1.5.0-ibm security update 2012-11-16 02:06:33 UTC
Red Hat Product Errata RHSA-2012:1466 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2012-11-16 02:16:50 UTC
Red Hat Product Errata RHSA-2012:1467 normal SHIPPED_LIVE Critical: java-1.7.0-ibm security update 2012-11-16 02:06:24 UTC
Red Hat Product Errata RHSA-2012:1485 normal SHIPPED_LIVE Critical: java-1.4.2-ibm security update 2012-11-22 23:14:28 UTC
Red Hat Product Errata RHSA-2013:1455 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2013-10-23 20:30:21 UTC
Red Hat Product Errata RHSA-2013:1456 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2013-10-23 20:29:56 UTC

Description Stefan Cornelius 2012-10-11 09:31:39 UTC
Sami Koivu's blog post from 2009 describes an information leak in the java.io.FilePermission class.  Patch name specified as a constructor argument is transformed to a canonical path internally.  Hash code of this canonical path is exposed via FilePermission's hashCode() method.  Sandboxed code could possibly use this flaw to get information about file system paths (such as JVM current directory - user.dir, or user's home directory).  Blog post also describes that this issued can be used to check existence of files or directories on system with case insensitive file systems (such as Windows).

http://slightlyrandombrokenthoughts.blogspot.com/2009/12/filepermission-class-leaks-sensitive.html

Comment 3 errata-xmlrpc 2012-10-17 16:10:36 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1386 https://rhn.redhat.com/errata/RHSA-2012-1386.html

Comment 4 errata-xmlrpc 2012-10-17 16:10:49 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1385 https://rhn.redhat.com/errata/RHSA-2012-1385.html

Comment 5 errata-xmlrpc 2012-10-17 16:11:36 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1384 https://rhn.redhat.com/errata/RHSA-2012-1384.html

Comment 7 errata-xmlrpc 2012-10-18 16:45:46 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1391 https://rhn.redhat.com/errata/RHSA-2012-1391.html

Comment 8 errata-xmlrpc 2012-10-18 16:56:41 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1392 https://rhn.redhat.com/errata/RHSA-2012-1392.html

Comment 9 errata-xmlrpc 2012-11-15 21:08:25 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1467 https://rhn.redhat.com/errata/RHSA-2012-1467.html

Comment 10 errata-xmlrpc 2012-11-15 21:10:05 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1465 https://rhn.redhat.com/errata/RHSA-2012-1465.html

Comment 11 errata-xmlrpc 2012-11-15 21:17:31 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1466 https://rhn.redhat.com/errata/RHSA-2012-1466.html

Comment 12 errata-xmlrpc 2012-11-22 18:15:23 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1485 https://rhn.redhat.com/errata/RHSA-2012-1485.html

Comment 13 errata-xmlrpc 2013-10-23 16:32:29 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html

Comment 14 errata-xmlrpc 2013-10-23 17:06:27 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html


Note You need to log in before you can comment on or make changes to this bug.