Denial of service - CVE-2017-3526

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6694

Denial of service - CVE-2017-3526

Published: May 24, 2017 / Updated: November 22, 2018


Vulnerability identifier: #VU6694
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3526
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists due to unknown error. A remote attacker can trick the victim into visiting a specially crafted webpage and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

Gentoo Linux
SUSE Linux
Ubuntu
Opensuse
IBM Cognos Controller
java-1.6.0-sun-src (Red Hat package)
java-1.6.0-sun-plugin (Red Hat package)
java-1.6.0-sun (Red Hat package)
java-1.6.0-sun-jdbc (Red Hat package)
java-1.6.0-sun-demo (Red Hat package)
java-1.6.0-sun-devel (Red Hat package)
java-1.7.0-oracle (Red Hat package)
java-1.7.0-oracle-src (Red Hat package)
java-1.7.0-oracle-devel (Red Hat package)
java-1.7.0-oracle-javafx (Red Hat package)
java-1.7.0-oracle-plugin (Red Hat package)
java-1.7.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-src (Red Hat package)
java-1.8.0-oracle-plugin (Red Hat package)
java-1.8.0-oracle-jdbc (Red Hat package)
java-1.8.0-oracle-javafx (Red Hat package)
java-1.8.0-oracle-devel (Red Hat package)
java-1.8.0-oracle (Red Hat package)

How to mitigate CVE-2017-3526

Install update from vendor's website.

java-1.6.0-sun-src (Red Hat package) - addressed in versions 1.6.0.151-1jpp.1.el6, 1.6.0.151-1jpp.1.el7_3
java-1.6.0-sun-plugin (Red Hat package) - addressed in versions 1.6.0.151-1jpp.1.el6, 1.6.0.151-1jpp.1.el7_3
java-1.6.0-sun (Red Hat package) - addressed in versions 1.6.0.151-1jpp.1.el6, 1.6.0.151-1jpp.1.el7_3
java-1.6.0-sun-jdbc (Red Hat package) - addressed in versions 1.6.0.151-1jpp.1.el6, 1.6.0.151-1jpp.1.el7_3
java-1.6.0-sun-demo (Red Hat package) - addressed in versions 1.6.0.151-1jpp.1.el6, 1.6.0.151-1jpp.1.el7_3
java-1.6.0-sun-devel (Red Hat package) - addressed in versions 1.6.0.151-1jpp.1.el6, 1.6.0.151-1jpp.1.el7_3
java-1.7.0-oracle (Red Hat package) - addressed in versions 1.7.0.141-1jpp.1.el6, 1.7.0.141-1jpp.1.el7_3
java-1.7.0-oracle-src (Red Hat package) - addressed in versions 1.7.0.141-1jpp.1.el6, 1.7.0.141-1jpp.1.el7_3
java-1.7.0-oracle-devel (Red Hat package) - addressed in versions 1.7.0.141-1jpp.1.el6, 1.7.0.141-1jpp.1.el7_3
java-1.7.0-oracle-javafx (Red Hat package) - addressed in versions 1.7.0.141-1jpp.1.el6, 1.7.0.141-1jpp.1.el7_3
java-1.7.0-oracle-plugin (Red Hat package) - addressed in versions 1.7.0.141-1jpp.1.el6, 1.7.0.141-1jpp.1.el7_3
java-1.7.0-oracle-jdbc (Red Hat package) - addressed in versions 1.7.0.141-1jpp.1.el6, 1.7.0.141-1jpp.1.el7_3
java-1.8.0-oracle-src (Red Hat package) - addressed in versions 1.8.0.131-1jpp.1.el6, 1.8.0.131-1jpp.1.el7_3
java-1.8.0-oracle-plugin (Red Hat package) - addressed in versions 1.8.0.131-1jpp.1.el6, 1.8.0.131-1jpp.1.el7_3
java-1.8.0-oracle-jdbc (Red Hat package) - addressed in versions 1.8.0.131-1jpp.1.el6, 1.8.0.131-1jpp.1.el7_3
java-1.8.0-oracle-javafx (Red Hat package) - addressed in versions 1.8.0.131-1jpp.1.el6, 1.8.0.131-1jpp.1.el7_3
java-1.8.0-oracle-devel (Red Hat package) - addressed in versions 1.8.0.131-1jpp.1.el6, 1.8.0.131-1jpp.1.el7_3
java-1.8.0-oracle (Red Hat package) - addressed in versions 1.8.0.131-1jpp.1.el6, 1.8.0.131-1jpp.1.el7_3

External References

Related Security Bulletins