Oracle Java SE Hotspot JSR 292 Method Handles RCE

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Windows host contains a programming platform that is
affected by an arbitrary code execution vulnerability.

Description :

The version of Oracle Java SE or Java for Business installed on the
remote host is affected by an arbitrary code execution vulnerability
in the Hotspot subcomponent due to an unsafe implementation of the
Reflection API, which improperly processes JSR 292 method handles due
to a lack of enforcement of class loader constraints. A remote
attacker can exploit this, by convincing a user to visit a malicious
web page, to execute arbitrary code outside the Java sandbox.

See also :

https://blogs.oracle.com/security/entry/security_alert_cve_2016_0636
http://www.nessus.org/u?f50143a4

Solution :

Upgrade to Oracle JDK / JRE 8 Update 77, 7 Update 99 or later.
If necessary, remove any affected versions.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 90828 ()

Bugtraq ID:

CVE ID: CVE-2016-0636

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now