CVE-2017-10355 in Java SE
Summary
by MITRE
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2025
This vulnerability exists within the networking component of Oracle Java SE and JRockit runtime environments, specifically affecting versions including Java SE 6u161, 7u151, 8u144, and 9, along with Java SE Embedded 8u144 and JRockit R28.3.15. The flaw represents a significant security weakness that can be exploited by unauthenticated remote attackers who have network access to the affected systems. According to the CVSS 3.0 scoring system, this vulnerability carries a base score of 5.3 with a vector indicating network accessibility, low attack complexity, no privilege requirements, and no user interaction needed, resulting in a partial denial of service impact. The vulnerability's exploitability is particularly concerning as it can be triggered through multiple network protocols and does not require any special privileges or authentication from the attacker.
The technical nature of this vulnerability stems from improper handling of network data within the Java networking stack, which creates opportunities for attackers to manipulate network communications in ways that can disrupt service availability. The flaw allows for partial denial of service conditions that can impact the normal operation of Java applications running on affected platforms. The vulnerability's reach extends beyond traditional sandboxed applications, as it can be exploited through Java Web Start applications and applets, but also through direct API calls without requiring sandboxed execution environments. This broad attack surface makes the vulnerability particularly dangerous as it can be leveraged through various attack vectors including web services and direct network connections. The weakness aligns with CWE-20, which describes improper input validation, and represents a classic case of insufficient data validation in network protocol handling.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise the availability of critical Java-based applications and services. Organizations running affected Java versions may experience partial denial of service conditions that can affect business operations, particularly in environments where Java applications are essential for core business functions. The vulnerability's ability to be exploited through both sandboxed and non-sandboxed execution contexts means that traditional security boundaries may not provide adequate protection. Attackers can leverage this weakness to consume system resources or disrupt network communications, potentially leading to cascading effects throughout the network infrastructure. The fact that this vulnerability can be triggered through web services and API integrations makes it particularly dangerous in enterprise environments where Java applications interact with numerous external systems and services.
Mitigation strategies for this vulnerability should focus on immediate patching of affected systems with the latest Oracle security updates, which would address the underlying networking component flaws. Organizations should also implement network segmentation and access controls to limit exposure to the affected components, particularly in environments where Java applications are accessible from untrusted networks. Network monitoring should be enhanced to detect unusual traffic patterns that might indicate exploitation attempts, and security teams should review application configurations to ensure that unnecessary network access is restricted. The vulnerability's classification under CVSS 3.0's availability impact category (A:L) indicates that organizations should prioritize availability controls and implement redundant systems where critical Java applications are deployed. Additionally, organizations should consider implementing network intrusion detection systems that can identify and alert on potential exploitation attempts targeting the specific networking protocols and components affected by this vulnerability, aligning with ATT&CK technique T1190 for exploit public-facing application.