Java Attach API Vulnerability in Eclipse OpenJ9 and IBM JVM
CVE-2018-12539

7.8HIGH

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Openj9
Vendor
CVE Published:
14 August 2018

What is CVE-2018-12539?

In Eclipse OpenJ9 version 0.8, a significant vulnerability exists that allows users, other than the process owner, to connect to the JVM using the Java Attach API. This API enables operations that include the execution of untrusted native code—significantly heightening security risks. By default, the Attach API is enabled on Windows, Linux, and AIX JVMs, which can potentially expose the system to unauthorized access. Administrators are advised to disable this feature using the command line option -Dcom.ibm.tools.attach.enable=no for enhanced security.

Affected Version(s)

Eclipse OpenJ9 0.8

References

https://access.redhat.com/errata/RHSA-2018:2713
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2575
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2576
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.