The default Java security properties configuration did not restrict access to sub-packages of the com.sun.corba.se package. An untrusted Java application or applet could use this flaw to trigger denial of service. This update lists whole com.sun.corba.se package as restricted in the java.security file.
Public now via Oracle CPU January 2014. Fixed in Oracle JDK 7u51, 6u71 and 5.0u61. External References: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Related note in the release notes: http://www.oracle.com/technetwork/java/javase/7u51-relnotes-2085002.html Area:otherlibs/corba Synopsis:com.sun.corba.se.** should be on restricted package list. The JDK internal package com.sun.corba.se and its sub-packages have been added to the restricted package list and therefore cannot be used directly when running with a security manager. Workaround: Applications running with a security manager that make direct use of classes in these JDK internal packages, need to adjust their security policy to grant access. See Java Security Policy Files documentation. See 8021257.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2014:0027 https://rhn.redhat.com/errata/RHSA-2014-0027.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0026 https://rhn.redhat.com/errata/RHSA-2014-0026.html
OpenJDK7 upstream commits: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/694ad155b344 http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/f15d0e49b1d8
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2014:0030 https://rhn.redhat.com/errata/RHSA-2014-0030.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2014:0097 https://rhn.redhat.com/errata/RHSA-2014-0097.html
Fixed in: IcedTea7 2.3.13 and 2.4.4: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025800.html IcedTea6 1.12.8 and 1.13.1: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025947.html OpenJDK 6 B30: http://mail.openjdk.java.net/pipermail/jdk6-dev/2014-January/003212.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2014:0135 https://rhn.redhat.com/errata/RHSA-2014-0135.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2014:0134 https://rhn.redhat.com/errata/RHSA-2014-0134.html
This issue has been addressed in following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Via RHSA-2014:0414 https://rhn.redhat.com/errata/RHSA-2014-0414.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 7 Via RHSA-2014:0705 https://rhn.redhat.com/errata/RHSA-2014-0705.html
This issue has been addressed in following products: Red Hat Network Satellite Server v 5.4 Red Hat Network Satellite Server v 5.5 Red Hat Satellite Server v 5.6 Via RHSA-2014:0982 https://rhn.redhat.com/errata/RHSA-2014-0982.html
Mitigation: Applications running with a security manager that make direct use of classes in these JDK internal packages, need to adjust their security policy to grant access. See Java Security Policy Files documentation.