Discover Government News

Arch Linux Security Advisory ASA-201603-25
=========================================
Severity: Critical
Date    : 2016-03-29
CVE-ID  : CVE-2016-0636
Package : jdk8-openjdk
Type    : sandbox escape
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package jdk8-openjdk before version 8.u77-1 is vulnerable to sandbox
escape leading to execution of unintended operations.

Resolution
=========
Upgrade to 8.u77-1.

# pacman -Syu "jdk8-openjdk>=8.u77-1"

The problem has been fixed upstream in version 8.u77.

Workaround
=========
None.

Description
==========
It was discovered that the security fix for CVE-2013-5838 was incomplete
and still allowed remote attackers to escape the Java security sandbox
mechanism.
The root problem is that the Reflection API does not properly guarantee
type safety when Method Handle objects were invoked across two different
Class Loader namespaces.
A part of the original patch was to use the "loadersAreRelated()" method
to ensure that the two Class Loaders are related, which is a condition
for correct type safety.
However, this condition could be easily fulfilled by abusing certain
behaviors in the class loading process, which could allow an attacker
to bypass the type safety checks and ultimately escape the security
sandbox mechanism.

Impact
=====
A remote attacker who is able to run an untrusted Java application or
applet is able to bypass Java sandbox restrictions and execute
unintended operations.

References
=========
https://www.oracle.com/security-alerts/alert-cve-2016-0636.html
https://access.redhat.com/security/cve/CVE-2016-0636

ArchLinux: 201603-25: jdk8-openjdk: sandbox escape

March 29, 2016

Summary

It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism.

Resolution

Upgrade to 8.u77-1. # pacman -Syu "jdk8-openjdk>=8.u77-1"
The problem has been fixed upstream in version 8.u77.

References

https://www.oracle.com/security-alerts/alert-cve-2016-0636.html https://access.redhat.com/security/cve/CVE-2016-0636

Severity
Package : jdk8-openjdk
Type : sandbox escape
Remote : Yes
Link : https://wiki.archlinux.org/title/CVE

Workaround

None.

Related News