Junglewise Threat Intelligence

CVE-2017-3231: Oracle Java SE information disclosure in Networking URLClassLoader

CVE-2017-3231 · Severity: medium · CVSS 4.3 · Published 2017-01-27

Technologies: Oracle Java SE, Oracle Java SE Embedded. Vendors: Oracle.

Executive brief

A vulnerability exists in the Networking subcomponent of Oracle Java SE and Java SE Embedded. This issue primarily affects client-side Java applications, such as those running in a web browser or via Java Web Start, that execute untrusted code from the internet. If exploited, an attacker could gain unauthorized access to a limited portion of the data accessible to the Java application, potentially compromising sensitive information. Exploitation requires a user to perform a specific action, such as visiting a malicious website.

Technical details

This vulnerability is classified as an information disclosure (CWE-200) within the Networking subcomponent of Oracle Java SE, specifically related to insufficient access control checks in the URLClassLoader. It is exploitable by an unauthenticated attacker over a network via multiple protocols. The attack requires human interaction (User Interaction: Required), typically involving a user running a sandboxed Java Web Start application or applet that loads untrusted code. A successful exploit allows the attacker to obtain unauthorized read access to a subset of data accessible to the Java environment. This vulnerability was addressed in the Oracle Critical Patch Update for January 2017.

Affected products

  • Oracle Java SE 6u131, 7u121, 8u112
  • Oracle Java SE Embedded 8u111

Timeline

  • 2017-01-17: advisory: Oracle Critical Patch Update released
  • 2017-01-19: patched: Red Hat released security updates for affected Java packages
  • 2017-01-27: disclosed: NVD publication date

References

Related threats