SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Embedded Server/Appliance)  >   Juniper Junos Space Vendors:   Juniper
(Juniper Issues Fix for Juniper Junos Space) Oracle Java SE Multiple Flaws Let Remote Users Access and Modify Data, Deny Service, and Gain Elevated Privileges
SecurityTracker Alert ID:  1041331
SecurityTracker URL:  http://securitytracker.com/id/1041331
CVE Reference:   CVE-2017-10295, CVE-2017-10345, CVE-2017-10355, CVE-2017-10356, CVE-2017-10388   (Links to External Site)
Date:  Jul 19 2018
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Multiple vulnerabilities were reported in Oracle Java SE. A remote user can access data and modify on the target system. A remote user can cause denial of service conditions on the target system. A remote user can gain elevated privileges. Juniper Junos Space is affected.

A remote user can exploit a flaw in the Hotspot component to gain elevated privileges [CVE-2017-10346].

A remote user can exploit a flaw in the RMI component to gain elevated privileges [CVE-2017-10285].

A remote user can exploit a flaw in the Libraries component to gain elevated privileges [CVE-2017-10388].

A remote user can exploit a flaw in the Deployment component to partially access data, partially modify data, and partially deny service [CVE-2017-10309].

A remote user can exploit a flaw in the Smart Card IO component to access and modify data [CVE-2017-10274].

A local user can exploit a flaw in the Security component to access data [CVE-2017-10356].

A remote user can exploit a flaw in the Javadoc component to partially access and partially modify data [CVE-2017-10293].

A remote user can exploit a flaw in the Server component to cause partial denial of service conditions [CVE-2017-10342].

A remote user can exploit a flaw in the JAX-WS component to cause partial denial of service conditions [CVE-2017-10350].

A remote user can exploit a flaw in the JAXP component to cause partial denial of service conditions [CVE-2017-10349].

A remote user can exploit a flaw in the Libraries component to cause partial denial of service conditions [CVE-2017-10348].

A remote user can exploit a flaw in the Serialization component to cause partial denial of service conditions [CVE-2017-10357].

A remote user can exploit a flaw in the Util (zlib) component to partially modify data [CVE-2016-9841].

A remote user can exploit a flaw in the 2D (Little CMS 2) component to partially access data [CVE-2016-10165].

A remote user can exploit a flaw in the Networking component to cause partial denial of service conditions [CVE-2017-10355].

A remote user can exploit a flaw in the Serialization component to cause partial denial of service conditions [CVE-2017-10281, CVE-2017-10347].

A remote authenticated user can exploit a flaw in the Sever component to partially access and partially modify data [CVE-2017-10386].

A remote user can exploit a flaw in the Server component to partially access and partially modify data [CVE-2017-10380].

A remote user can exploit a flaw in the Networking component to partially modify data [CVE-2017-10295].

A remote user can exploit a flaw in the Server component to partially modify data [CVE-2017-10341].

A remote user can exploit a flaw in the Serialization component to cause partial denial of service conditions [CVE-2017-10345].

An Anonymous researcher (via Beyond Security's SecuriTeam Secure Disclosure Program), Daniel Frojdendahl, Francesco Palmarini of Ca Foscari University of Venice, Gaston Traberg of Onapsis, Jeffrey Altman of Secure Endpoints Inc.,
Marco Squarcina of Ca Foscari University of Venice, Mauro Tempesta of Ca Foscari University of Venice, Orange Tsai, Riccardo Focardi of Ca Foscari University of Venice, Steven Seeley of Source Incite, Tamas Szakaly, and Tobias Ospelt of modzero reported these vulnerabilities.

Impact:   A remote user can obtain data on the target system.

A remote user can modify data on the target system.

A remote user can cause denial of service conditions.

A remote user can gain elevated privileges on the target system.

Solution:   Juniper has issued a fix for CVE-2017-10295, CVE-2017-10345, CVE-2017-10355, CVE-2017-10356, and CVE-2017-10388 for Juniper Junos Space (18.1R1).

The Juniper advisory is available at:

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10873

Vendor URL:  kb.juniper.net/InfoCenter/index?page=content&id=JSA10873 (Links to External Site)
Cause:   Not specified

Message History:   This archive entry is a follow-up to the message listed below.
Oct 17 2017 Oracle Java SE Multiple Flaws Let Remote Users Access and Modify Data, Deny Service, and Gain Elevated Privileges



 Source Message Contents

Subject:  https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10873

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC