CVE-2017-10349 in Java SE
Summary
by MITRE
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/18/2021
The vulnerability identified as CVE-2017-10349 resides within the Java SE and Java SE Embedded components, specifically affecting the Java API for XML Processing (JAXP) subcomponent. This weakness manifests in versions Java SE 6u161, 7u151, 8u144, and 9, alongside Java SE Embedded 8u144, representing a significant security concern for environments utilizing these Java runtime versions. The vulnerability's classification as easily exploitable indicates that attackers can leverage network-based attacks without requiring authentication, making it particularly dangerous in exposed environments where network access is possible.
The technical flaw within JAXP stems from improper handling of XML parsing operations that allows maliciously crafted XML documents to trigger unexpected behavior in the Java runtime environment. This vulnerability operates through multiple network protocols, providing attackers with various attack vectors to exploit the weakness. The attack surface is particularly concerning because it targets Java deployments that execute untrusted code within sandboxed environments, such as Java Web Start applications or applets that load content from untrusted sources like the internet. The security model relies on the Java sandbox to isolate potentially malicious code, but this vulnerability bypasses those protective mechanisms.
From an operational impact perspective, successful exploitation of CVE-2017-10349 results in partial denial of service conditions that can severely disrupt Java applications running on affected systems. The CVSS 3.0 score of 5.3 with an availability impact vector indicates that while the attack does not provide direct access to system resources or data confidentiality, it can effectively render Java applications partially non-functional, impacting business operations and user productivity. The vulnerability's applicability to client-side deployments makes it particularly dangerous in enterprise environments where users frequently interact with web-based applications that may load untrusted Java content.
The attack scenario typically involves an unauthenticated network attacker who can deliver malicious XML content to vulnerable Java clients. This aligns with ATT&CK technique T1203 - Exploitation for Client Execution, where adversaries leverage vulnerabilities in client-side applications to execute malicious code. The vulnerability does not affect server-side Java deployments that run only trusted code, which provides a clear operational distinction for security teams to identify vulnerable systems. Organizations should consider implementing network segmentation and firewall rules to limit access to Java applications that are vulnerable to this attack vector.
Mitigation strategies for CVE-2017-10349 should prioritize immediate patching of affected Java versions to the latest supported releases from Oracle. Security teams should also implement network-based controls such as intrusion detection systems to monitor for suspicious XML content patterns and consider disabling Java applets and Web Start applications where possible. The vulnerability's characteristics align with CWE-20 - Improper Input Validation, emphasizing the importance of proper XML parsing validation. Organizations should also conduct comprehensive vulnerability assessments to identify all systems running affected Java versions and ensure that Java runtime environments are properly configured to prevent execution of untrusted code in sandboxed contexts. Additionally, implementing application whitelisting policies and restricting network access to Java applications can provide additional layers of defense against exploitation attempts.