NVD

Id
16793  
Name
CVE-2016-0363  
Description
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-06-03  
Modified Date
2016-11-29  
Seq
2016-0363  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
93337 16793 CVE-2016-0363 SUSE-SU-2016:1299  View
93338 16793 CVE-2016-0363 SUSE-SU-2016:1300  View
93339 16793 CVE-2016-0363 SUSE-SU-2016:1303  View
93340 16793 CVE-2016-0363 SUSE-SU-2016:1378  View
93341 16793 CVE-2016-0363 SUSE-SU-2016:1379  View
93342 16793 CVE-2016-0363 SUSE-SU-2016:1388  View
93343 16793 CVE-2016-0363 SUSE-SU-2016:1458  View
93344 16793 CVE-2016-0363 SUSE-SU-2016:1475  View
93345 16793 CVE-2016-0363 RHSA-2016:0701  View
93346 16793 CVE-2016-0363 RHSA-2016:0702  View
93347 16793 CVE-2016-0363 RHSA-2016:0708  View
93348 16793 CVE-2016-0363 RHSA-2016:0716  View
93349 16793 CVE-2016-0363 RHSA-2016:1039  View
93350 16793 CVE-2016-0363 20160405 Re: [SE-2012-01] Broken security fix in IBM Java 7/8  View
93351 16793 CVE-2016-0363 20160404 [SE-2012-01] Broken security fix in IBM Java 7/8  View
93352 16793 CVE-2016-0363 IX90172  View
93353 16793 CVE-2016-0363 http://www-01.ibm.com/support/docview.wss?uid=swg21980826  View
93354 16793 CVE-2016-0363 http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf  View
93355 16793 CVE-2016-0363 85895  View
93356 16793 CVE-2016-0363 1035953  View
93357 16793 CVE-2016-0363 RHSA-2016:1430  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2265 JVNDB-2016-003038 IBM SDK, Java Technology Edition の com.ibm.CORBA.iiop.ClientDelegate クラスにおける setSecurityManager を呼び出される脆弱性 IBM SDK, Java Technology Edition の com.ibm.CORBA.iiop.ClientDelegate クラスは、AccessController doPrivileged ブロックの java.lang.reflect.Method クラスの呼び出しメソッドを使用するため、setSecurityManager を呼び出され、サンドボックス保護メカニズムを回避される脆弱性が存在します。 CVE-2016-0363 86567 CVE-2016-0363 16793 6.8 8.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003038.html 2016-04-26 2016-08-26 View