Remote code execution in JRockit and Oracle Java SE - CVE-2017-3241
Published: July 5, 2017 / Updated: November 22, 2018
Vulnerability identifier: #VU7331
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2017-3241
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Oracle
Affected software:
JRockit
Oracle Java SE
JRockit
Oracle Java SE
Detailed vulnerability description
The vulnerability allows a remote unauthenticated attacker to execute arbitrary code.
The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the RMI component. A remote attacker can execute arbitrary code with privileges of the current user and compromise vulnerable system.
The weakness exists due to unknown error in Oracle Java SE Java SE Embedded and Jrockit related to the RMI component. A remote attacker can execute arbitrary code with privileges of the current user and compromise vulnerable system.
How to mitigate CVE-2017-3241
Install update from vendor's website.