CVE-2017-10347 in Java SE
Summary
by MITRE
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/18/2021
The vulnerability identified as CVE-2017-10347 represents a critical flaw within the Java Serialization component of Oracle Java SE and JRockit runtime environments. This weakness specifically affects multiple Java versions including Java SE 6u161, 7u151, 8u144, and 9, along with Java SE Embedded 8u144, making it a widespread concern across various deployment scenarios. The vulnerability resides in the serialization mechanism that processes serialized data streams, creating an attack surface that can be exploited by unauthenticated remote attackers with network access through multiple protocols. The CVSS score of 5.3 with a base vector indicating network accessibility, low attack complexity, and no privilege requirements demonstrates the severity and ease of exploitation inherent in this flaw. This vulnerability operates at the core of Java's object serialization framework, which is fundamental to how Java applications communicate and persist data across network boundaries and application restarts.
The technical exploitation of this vulnerability occurs through crafted serialized data that triggers unexpected behavior within the Java deserialization process. When Java applications process untrusted serialized data, particularly in sandboxed environments such as Java Web Start applications or applets, the vulnerable serialization code can be manipulated to execute arbitrary code or cause system instability. This flaw specifically impacts the deserialization phase where Java attempts to reconstruct objects from their serialized representations, creating opportunities for attackers to inject malicious payloads that bypass the standard security boundaries of the Java sandbox. The vulnerability's impact manifests as partial denial of service conditions, where successful exploitation can disrupt application availability without necessarily achieving complete system compromise or privilege escalation. The underlying issue stems from insufficient validation and sanitization of serialized data inputs, allowing attackers to manipulate the deserialization process through carefully crafted malicious objects that can trigger unexpected execution paths within the Java runtime environment.
The operational impact of CVE-2017-10347 extends significantly within enterprise environments where Java applications are commonly deployed, particularly in client-side applications that process data from untrusted sources. This vulnerability affects the fundamental security model of Java sandboxed applications, potentially allowing attackers to compromise the integrity and availability of systems that rely on Java's security boundaries for protection. The vulnerability's applicability to web-based applications, applets, and Web Start deployments creates extensive attack surfaces across organizations that utilize Java for client-side processing. Security teams must recognize that this vulnerability primarily affects client-side Java applications rather than server-side deployments where trusted code execution is typically assumed, though the potential for exploitation in client environments remains high given the widespread use of Java applets and Web Start applications. The partial denial of service impact means that while complete system compromise may not occur, the availability of Java applications can be significantly degraded, affecting business continuity and user experience.
Organizations should implement immediate mitigations including applying Oracle's security patches and updates to affected Java versions, as well as implementing network-level restrictions that limit access to Java applications that process untrusted data. The recommended approach includes disabling Java applets in web browsers, implementing proper network segmentation, and ensuring that Java applications only process trusted data sources. From a security controls perspective, this vulnerability aligns with CWE-502 which describes "Deserialization of Untrusted Data" as a common weakness in software security, making it particularly relevant to defensive strategies focused on input validation and secure coding practices. Organizations should also consider implementing runtime application self-protection mechanisms and monitoring for anomalous deserialization activities that could indicate exploitation attempts. The vulnerability's classification under the ATT&CK framework would fall under techniques related to code injection and privilege escalation through application-specific vulnerabilities, emphasizing the need for comprehensive application security monitoring and incident response procedures. Additionally, organizations should conduct thorough vulnerability assessments to identify all Java applications and deployments that might be exposed to this vulnerability, particularly focusing on legacy systems that may not have received timely security updates.