Bug 1443083 - (CVE-2017-3533) CVE-2017-3533 OpenJDK: newline injection in the FTP client (Networking, 8170222)
CVE-2017-3533 OpenJDK: newline injection in the FTP client (Networking, 8170222)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20170218,reported=2...
: Security
Depends On:
Blocks: 1438752
  Show dependency treegraph
 
Reported: 2017-04-18 08:47 EDT by Tomas Hoger
Modified: 2017-06-09 05:08 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A newline injection flaw was discovered in the FTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate FTP connections established by a Java application.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-05-10 09:47:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2017-04-18 08:47:08 EDT
It was discovered that the FTP client implementation in the Networking component of OpenJDK failed to correctly handle user inputs (e.g. usernames and passwords) containing newline characters.  A remote attacker could possibly use this flaw to manipulate an FTP connection opened by a Java application if it could make it access a specially crafted FTP URL.

Blog posts were published that describe how to use this flaw to open ports on firewalls using active FTP connections:

http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html

and sending mails during XML parsing when use of XML external entities is allowed:

https://shiftordie.de/blog/2017/02/18/smtp-over-xxe/
Comment 1 Tomas Hoger 2017-04-18 18:18:48 EDT
Public now via Oracle CPU April 20167, fixed in Oracle JDK 8u131, 7u141, and 6u151.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixJAVA
Comment 2 Tomas Hoger 2017-04-19 07:29:10 EDT
OpenJDK8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/81ddd5fc5a4e
Comment 3 errata-xmlrpc 2017-04-20 15:28:05 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1109 https://access.redhat.com/errata/RHSA-2017:1109
Comment 4 errata-xmlrpc 2017-04-20 22:11:45 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1108 https://access.redhat.com/errata/RHSA-2017:1108
Comment 5 errata-xmlrpc 2017-04-24 07:17:29 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:1118 https://access.redhat.com/errata/RHSA-2017:1118
Comment 6 errata-xmlrpc 2017-04-24 07:18:25 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:1117 https://access.redhat.com/errata/RHSA-2017:1117
Comment 7 errata-xmlrpc 2017-04-24 07:19:13 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:1119 https://access.redhat.com/errata/RHSA-2017:1119
Comment 8 errata-xmlrpc 2017-05-09 06:47:56 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1204 https://access.redhat.com/errata/RHSA-2017:1204
Comment 9 errata-xmlrpc 2017-05-10 08:47:15 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1222 https://access.redhat.com/errata/RHSA-2017:1222
Comment 10 errata-xmlrpc 2017-05-10 08:49:16 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary
  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1221 https://access.redhat.com/errata/RHSA-2017:1221
Comment 11 errata-xmlrpc 2017-05-10 08:51:25 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary
  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1220 https://access.redhat.com/errata/RHSA-2017:1220

Note You need to log in before you can comment on or make changes to this bug.