CVE-2018-2588MEDIUM
Description
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: LDAP). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
References
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.securityfocus.com/bid/102661
http://www.securitytracker.com/id/1040203
https://access.redhat.com/errata/RHSA-2018:0095
https://access.redhat.com/errata/RHSA-2018:0099
https://access.redhat.com/errata/RHSA-2018:0100
https://access.redhat.com/errata/RHSA-2018:0115
https://access.redhat.com/errata/RHSA-2018:0349
https://access.redhat.com/errata/RHSA-2018:0351
https://access.redhat.com/errata/RHSA-2018:0352
https://access.redhat.com/errata/RHSA-2018:0458
https://access.redhat.com/errata/RHSA-2018:0521
https://access.redhat.com/errata/RHSA-2018:1463
https://access.redhat.com/errata/RHSA-2018:1812
https://lists.debian.org/debian-lts-announce/2018/04/msg00003.html
https://security.netapp.com/advisory/ntap-20180117-0001/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03911en_us
https://usn.ubuntu.com/3613-1/
https://usn.ubuntu.com/3614-1/
Details
Source: MITRE
Published: 2018-01-18
Updated: 2020-09-08
Type: NVD-CWE-noinfo
Risk Information
CVSS v2.0
Base Score: 4
Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 8
Severity: MEDIUM
CVSS v3.0
Base Score: 4.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Impact Score: 1.4
Exploitability Score: 2.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:oracle:jdk:1.6.0:update_171:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update161:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update152:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update_171:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.7.0:update_161:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update_152:*:*:*:*:*:*
Configuration 2
OR
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Configuration 3
OR
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Configuration 4
OR
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Configuration 5
OR
cpe:2.3:a:schneider-electric:struxureware_data_center_expert:*:*:*:*:*:*:*:*
Configuration 6
OR
cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 127375 | NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0126) | Nessus | NewStart CGSL Local Security Checks | medium |
| 127372 | NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0124) | Nessus | NewStart CGSL Local Security Checks | medium |
| 127170 | NewStart CGSL MAIN 5.04 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0016) | Nessus | NewStart CGSL Local Security Checks | medium |
| 127162 | NewStart CGSL MAIN 5.04 : java-1.7.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0012) | Nessus | NewStart CGSL Local Security Checks | medium |
| 700656 | Oracle Java SE 6 < Update 181 / 7 < Update 171 / 8 < Update 161 / 9 < Update 4 Multiple Vulnerabilities (January 2018 CPU) | Nessus Network Monitor | Web Clients | high |
| 121911 | Photon OS 2.0: Openjdk8 PHSA-2018-2.0-0013 | Nessus | PhotonOS Local Security Checks | high |
| 111283 | Photon OS 2.0 : libtiff / openjdk8 / ruby (PhotonOS-PHSA-2018-2.0-0013) (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 110405 | RHEL 6 : java-1.7.1-ibm (RHSA-2018:1812) | Nessus | Red Hat Local Security Checks | medium |
| 109908 | RHEL 6 : java-1.8.0-ibm (RHSA-2018:1463) | Nessus | Red Hat Local Security Checks | medium |
| 109121 | Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2018-949) | Nessus | Amazon Linux Local Security Checks | medium |
| 108853 | Debian DSA-4166-1 : openjdk-7 - security update | Nessus | Debian Local Security Checks | medium |
| 108815 | Debian DLA-1339-1 : openjdk-7 security update | Nessus | Debian Local Security Checks | medium |
| 108794 | Ubuntu 14.04 LTS : openjdk-7 vulnerabilities (USN-3614-1) | Nessus | Ubuntu Local Security Checks | medium |
| 108793 | Ubuntu 16.04 LTS / 17.10 : openjdk-8 vulnerabilities (USN-3613-1) | Nessus | Ubuntu Local Security Checks | medium |
| 108599 | Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2018-974) | Nessus | Amazon Linux Local Security Checks | medium |
| 108512 | SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2018:0665-1) | Nessus | SuSE Local Security Checks | medium |
| 108510 | SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2018:0663-1) | Nessus | SuSE Local Security Checks | medium |
| 108482 | SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:0743-1) | Nessus | SuSE Local Security Checks | medium |
| 108463 | EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2018-1059) | Nessus | Huawei Local Security Checks | medium |
| 108462 | EulerOS 2.0 SP1 : java-1.7.0-openjdk (EulerOS-SA-2018-1058) | Nessus | Huawei Local Security Checks | medium |
| 108432 | GLSA-201803-06 : Oracle JDK/JRE: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 108421 | Debian DSA-4144-1 : openjdk-8 - security update | Nessus | Debian Local Security Checks | medium |
| 108400 | SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:0694-1) | Nessus | SuSE Local Security Checks | medium |
| 108362 | RHEL 6 : java-1.7.1-ibm (RHSA-2018:0521) | Nessus | Red Hat Local Security Checks | medium |
| 108357 | openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2018-256) | Nessus | SuSE Local Security Checks | medium |
| 108355 | openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2018-254) | Nessus | SuSE Local Security Checks | medium |
| 108280 | SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2018:0661-1) | Nessus | SuSE Local Security Checks | medium |
| 107288 | SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0645-1) | Nessus | SuSE Local Security Checks | medium |
| 107213 | SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2018:0630-1) | Nessus | SuSE Local Security Checks | medium |
| 107207 | RHEL 7 : java-1.7.1-ibm (RHSA-2018:0458) | Nessus | Red Hat Local Security Checks | medium |
| 107074 | CentOS 6 / 7 : java-1.7.0-openjdk (CESA-2018:0349) | Nessus | CentOS Local Security Checks | medium |
| 107021 | Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x, SL7.x i386/x86_64 (20180226) | Nessus | Scientific Linux Local Security Checks | medium |
| 107019 | RHEL 6 : java-1.8.0-ibm (RHSA-2018:0352) | Nessus | Red Hat Local Security Checks | medium |
| 107018 | RHEL 7 : java-1.8.0-ibm (RHSA-2018:0351) | Nessus | Red Hat Local Security Checks | medium |
| 107016 | RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2018:0349) | Nessus | Red Hat Local Security Checks | medium |
| 107014 | Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2018-0349) | Nessus | Oracle Linux Local Security Checks | medium |
| 106694 | Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2018-949) | Nessus | Amazon Linux Local Security Checks | medium |
| 106403 | EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2018-1028) | Nessus | Huawei Local Security Checks | medium |
| 106402 | EulerOS 2.0 SP1 : java-1.8.0-openjdk (EulerOS-SA-2018-1027) | Nessus | Huawei Local Security Checks | medium |
| 106256 | RHEL 6 / 7 : java-1.6.0-sun (RHSA-2018:0115) | Nessus | Red Hat Local Security Checks | medium |
| 106191 | Oracle Java SE Multiple Vulnerabilities (January 2018 CPU) (Unix) | Nessus | Misc. | medium |
| 106190 | Oracle Java SE Multiple Vulnerabilities (January 2018 CPU) | Nessus | Windows | medium |
| 106183 | RHEL 6 / 7 : java-1.7.0-oracle (RHSA-2018:0100) | Nessus | Red Hat Local Security Checks | medium |
| 106182 | RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2018:0099) | Nessus | Red Hat Local Security Checks | medium |
| 106172 | CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2018:0095) | Nessus | CentOS Local Security Checks | medium |
| 106139 | Oracle JRockit R28.3.16 Multiple Vulnerabilities (January 2018 CPU) | Nessus | Windows | medium |
| 106124 | Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x, SL7.x i386/x86_64 (20180117) | Nessus | Scientific Linux Local Security Checks | medium |
| 106122 | RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2018:0095) | Nessus | Red Hat Local Security Checks | medium |
| 106119 | Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2018-0095) | Nessus | Oracle Linux Local Security Checks | medium |