topic Re: CVE-2024-27267 java vulnerability of IBM in General Topics

CVE-2024-27267 java vulnerability of IBM

Firewall_Head — Mon, 04 Nov 2024 05:34:06 GMT

Dear Checkmates,

Please let me know if Check Point is affected by this vulnerability, if not kindly leave a link to the article that discusses about this CVE.

=======

Thanks & Regards,

FirewallHead

Re: CVE-2024-27267 java vulnerability of IBM

PhoneBoy — Mon, 04 Nov 2024 18:14:55 GMT

I would engage with the TAC here: https://help.checkpoint.com

Re: CVE-2024-27267 java vulnerability of IBM

Lesley — Tue, 05 Nov 2024 21:45:22 GMT

This one is for IBM:

CVEID: CVE-2024-27267
DESCRIPTION: The Object Request Broker (ORB) in IBM SDK, Java Technology Edition is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/284573 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM SDK, Java Technology Edition	7.1.0.0 - 7.1.5.18 (restricted access)
IBM SDK, Java Technology Edition	8.0.0.0 - 8.0.8.26

For detailed information on which CVEs affect which releases, please refer to the IBM SDK, Java Technology Edition Security Vulnerabilities page.

Re: CVE-2024-27267 java vulnerability of IBM

G_W_Albrecht — Wed, 06 Nov 2024 09:10:53 GMT

# java -version
java version "1.8.0_401"
Java(TM) SE Runtime Environment (build 8.0.8.21 - pxi3280sr8fp21-20240221_01(SR8 FP21))
IBM J9 VM (build 2.9, JRE 1.8.0 Linux x86-32-Bit 20240216_65882 (JIT enabled, AO T enabled)
OpenJ9 - 6a2a245
OMR - 9440e34
IBM - 7394519)
JCL - 20231221_01 based on Oracle jdk8u401-b10

Re: CVE-2024-27267 java vulnerability of IBM

PhoneBoy — Wed, 06 Nov 2024 15:14:47 GMT

In general, the ability to exploit the vulnerabilities here are low since:

Gateways don't actually use java (though the binaries are there)
On Management, the relevant Java processes are reversed proxied through Apache, which limits the external traffic that can reach the inner processes and thus exploit the relevant CVE.

It appears that we are planning to release fixes in upcoming JHFs, in any case.
TAC should be consulted for further details: https://help.checkpoint.com