IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.

Threat-Mapped Scoring

Score: 3.0

Priority: P2 - Serious (High)

• S1 – Steal Customer Account Information

EPSS

Score: 0.01534
Percentile: 0.80518

CVSS Scoring

Mapped CWE(s)

• CWE-200 : Exposure of Sensitive Information to an Unauthorized Actor

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1217 : Browser Information Discovery
  Kill Chain: discovery
• T1592 : Gather Victim Host Information
  Kill Chain: reconnaissance
• T1595 : Active Scanning
  Kill Chain: reconnaissance
• T1018 : Remote System Discovery
  Kill Chain: discovery
• T1124 : System Time Discovery
  Kill Chain: discovery
• T1046 : Network Service Discovery
  Kill Chain: discovery
• T1016 : System Network Configuration Discovery
  Kill Chain: discovery
• T1049 : System Network Connections Discovery
  Kill Chain: discovery
• T1590 : Gather Victim Network Information
  Kill Chain: reconnaissance
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1083 : File and Directory Discovery
  Kill Chain: discovery
• T1057 : Process Discovery
  Kill Chain: discovery
• T1007 : System Service Discovery
  Kill Chain: discovery
• T1087 : Account Discovery
  Kill Chain: discovery
• T1069 : Permission Groups Discovery
  Kill Chain: discovery
• T1615 : Group Policy Discovery
  Kill Chain: discovery
• T1033 : System Owner/User Discovery
  Kill Chain: discovery
• T1134.001 : Token Impersonation/Theft
  Kill Chain: defense-evasion
• T1550.004 : Web Session Cookie
  Kill Chain: defense-evasion
• T1036.005 : Match Legitimate Resource Name or Location
  Kill Chain: defense-evasion
• T1135 : Network Share Discovery
  Kill Chain: discovery
• T1120 : Peripheral Device Discovery
  Kill Chain: discovery
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:redhat:icedtea:*:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.5:rc1:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.5:rc2:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.5:rc3:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.6:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.7:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.8:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.8.1:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.8.2:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:icedtea:1.9:*:*:*:*:*:*:*

← Back to Home