bugtraq - [SE-2014-02] Errata document for Issue 42 (CVE-2015-4871 affecting Java SE 7)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <565C86F8.8060208@security-explorations.com>
Date: Mon, 30 Nov 2015 18:27:20 +0100
From: Security Explorations <contact@...urity-explorations.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [SE-2014-02] Errata document for Issue 42 (CVE-2015-4871 affecting
 Java SE 7)

Hello All,

On Jun 30, 2015 Security Explorations reported a security vulnerability
(Issue 42 assigned CVE-2015-4871) to Oracle affecting Java SE 7 [1].

In our original report [2], we indicated that the vulnerability had its
origin in klassItable::initialize_itable_for_interface method's
implementation of Java SE 7 HotSpot VM. We have recently learned that
our initial analysis regarding the root cause of Issue 42 was incorrect.

As a result, we have published an errata document that is available for
download from the following address:

http://www.security-explorations.com/materials/SE-2014-02-ORACLE-ERRATA.pdf

It contains more detailed information about the actual cause of Issue
42, the reasoning that has mislead us into concluding it was caused by
an improper initialization of non-public interface method slots and
some additional findings regarding this issue.

The case of incorrect analysis regarding the root cause of Issue 42 has
reminded us that in the world of security vulnerabilities, incorrect or
unverified assumptions can easily lead to wrong conclusions. These are
usually the software vendors that fall victim of it. As it turns out,
the very same can happen to security researchers.

Thank you.

Best Regards,
Adam Gowdiak

---------------------------------------------
Security Explorations
http://www.security-explorations.com
"We bring security research to the new level"
---------------------------------------------

References:
[1] SE-2014-02 Vendors status
     http://www.security-explorations.com/en/SE-2014-02-status.html
[2] SE-2014-02-ORACLE, Issue #42
     http://www.security-explorations.com/materials/SE-2014-02-ORACLE.pdf