CVE Vulnerabilities

CVE-2014-1876

Improper Link Resolution Before File Access ('Link Following')

Published: Feb 10, 2014 | Modified: Jan 05, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
1.9 LOW
AV:L/AC:M/Au:N/C:N/I:P/A:N
RedHat/V3
Ubuntu

The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.

Weakness

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name Vendor Start Version End Version
Openjdk Oracle 1.6.0 1.6.0
Openjdk Oracle 1.7.0 1.7.0
Openjdk Oracle 1.8.0 1.8.0
Oracle Java for Red Hat Enterprise Linux 5 RedHat java-1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 *
Oracle Java for Red Hat Enterprise Linux 5 RedHat java-1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10 *
Oracle Java for Red Hat Enterprise Linux 6 RedHat java-1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 *
Oracle Java for Red Hat Enterprise Linux 6 RedHat java-1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5 *
Red Hat Enterprise Linux 5 RedHat java-1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el5_10 *
Red Hat Enterprise Linux 5 RedHat java-1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el5_10 *
Red Hat Enterprise Linux 6 RedHat java-1.7.0-openjdk-1:1.7.0.55-2.4.7.1.el6_5 *
Red Hat Enterprise Linux 6 RedHat java-1.6.0-openjdk-1:1.6.0.0-5.1.13.3.el6_5 *
Red Hat Enterprise Linux 7 RedHat java-1.7.0-openjdk-1:1.7.0.55-2.4.7.2.el7_0 *
Red Hat Enterprise Linux 7 RedHat java-1.6.0-openjdk-1:1.6.0.0-6.1.13.3.el7_0 *
Red Hat Network Satellite Server v 5.4 RedHat java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5 *
Red Hat Network Satellite Server v 5.5 RedHat java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5 *
Red Hat Satellite 5.6 RedHat java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5 *
Supplementary for Red Hat Enterprise Linux 5 RedHat java-1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 *
Supplementary for Red Hat Enterprise Linux 5 RedHat java-1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el5_10 *
Supplementary for Red Hat Enterprise Linux 5 RedHat java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5_10 *
Supplementary for Red Hat Enterprise Linux 5 RedHat java-1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el5_10 *
Supplementary for Red Hat Enterprise Linux 6 RedHat java-1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 *
Supplementary for Red Hat Enterprise Linux 6 RedHat java-1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el6_5 *
Supplementary for Red Hat Enterprise Linux 6 RedHat java-1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6_5 *
Supplementary for Red Hat Enterprise Linux 6 RedHat java-1.5.0-ibm-1:1.5.0.16.6-1jpp.1.el6_5 *
Supplementary for Red Hat Enterprise Linux 7 RedHat java-1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0 *
Openjdk-6 Ubuntu lucid *
Openjdk-6 Ubuntu precise *
Openjdk-6 Ubuntu quantal *
Openjdk-6 Ubuntu saucy *
Openjdk-7 Ubuntu devel *
Openjdk-7 Ubuntu precise *
Openjdk-7 Ubuntu quantal *
Openjdk-7 Ubuntu saucy *
Openjdk-7 Ubuntu trusty *

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References