CVE-2016-0363
HighSummary
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25, 6 R1 before SR8 FP25, 7 before SR9 FP40, 7 R1 before SR3 FP40, and 8 before SR3 uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, allowing remote attackers to call setSecurityManager and bypass a sandbox protection mechanism.
Risk Assessment
This vulnerability allows remote attackers to gain control over the application's security settings, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to upgrade to the latest version of IBM SDK to eliminate this vulnerability and ensure adequate protections against unauthorized access.
Other vulnerabilities in IBM SDK, Java Technology Edition
See all- CVE-2017-1289High
IBM SDK, Java Technology Edition is vulnerable to XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2016-0376High
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition before SR16 FP25 improperly deserializes classes in an AccessController doPrivileged block, allowing remote attackers to bypass a sandbox protection mechanism and execute arbitrary code.
- CVE-2014-8892High
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to bypass intended access permissions and obtain sensitive information.
- CVE-2014-8891High
An unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition allows remote attackers to escape the Java sandbox and execute arbitrary code.
Original NVD description (English source)
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.